projects / deliverable / linux.git / blob
? search:


c3ee902306d876b72f148fa6984fb1adf6e88728
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/net_namespace.h>
56 #include <net/netlabel.h>
57 #include <linux/uaccess.h>
58 #include <asm/ioctls.h>
59 #include <linux/atomic.h>
60 #include <linux/bitops.h>
61 #include <linux/interrupt.h>
62 #include <linux/netdevice.h> /* for network interface checks */
63 #include <linux/netlink.h>
64 #include <linux/tcp.h>
65 #include <linux/udp.h>
66 #include <linux/dccp.h>
67 #include <linux/quota.h>
68 #include <linux/un.h> /* for Unix socket types */
69 #include <net/af_unix.h> /* for Unix socket types */
70 #include <linux/parser.h>
71 #include <linux/nfs_mount.h>
72 #include <net/ipv6.h>
73 #include <linux/hugetlb.h>
74 #include <linux/personality.h>
75 #include <linux/audit.h>
76 #include <linux/string.h>
77 #include <linux/selinux.h>
78 #include <linux/mutex.h>
79 #include <linux/posix-timers.h>
80 #include <linux/syslog.h>
81 #include <linux/user_namespace.h>
82 #include <linux/export.h>
83 #include <linux/msg.h>
84 #include <linux/shm.h>
85
86 #include "avc.h"
87 #include "objsec.h"
88 #include "netif.h"
89 #include "netnode.h"
90 #include "netport.h"
91 #include "xfrm.h"
92 #include "netlabel.h"
93 #include "audit.h"
94 #include "avc_ss.h"
95
96 #define NUM_SEL_MNT_OPTS 5
97
98 extern struct security_operations *security_ops;
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!strict_strtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!strict_strtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132
133 /**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled.
141 *
142 */
143 static int selinux_secmark_enabled(void)
144 {
145 return (atomic_read(&selinux_secmark_refcount) > 0);
146 }
147
148 /*
149 * initialise the security for the init task
150 */
151 static void cred_init_security(void)
152 {
153 struct cred *cred = (struct cred *) current->real_cred;
154 struct task_security_struct *tsec;
155
156 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
157 if (!tsec)
158 panic("SELinux: Failed to initialize initial task.\n");
159
160 tsec->osid = tsec->sid = SECINITSID_KERNEL;
161 cred->security = tsec;
162 }
163
164 /*
165 * get the security ID of a set of credentials
166 */
167 static inline u32 cred_sid(const struct cred *cred)
168 {
169 const struct task_security_struct *tsec;
170
171 tsec = cred->security;
172 return tsec->sid;
173 }
174
175 /*
176 * get the objective security ID of a task
177 */
178 static inline u32 task_sid(const struct task_struct *task)
179 {
180 u32 sid;
181
182 rcu_read_lock();
183 sid = cred_sid(__task_cred(task));
184 rcu_read_unlock();
185 return sid;
186 }
187
188 /*
189 * get the subjective security ID of the current task
190 */
191 static inline u32 current_sid(void)
192 {
193 const struct task_security_struct *tsec = current_security();
194
195 return tsec->sid;
196 }
197
198 /* Allocate and free functions for each kind of security blob. */
199
200 static int inode_alloc_security(struct inode *inode)
201 {
202 struct inode_security_struct *isec;
203 u32 sid = current_sid();
204
205 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
206 if (!isec)
207 return -ENOMEM;
208
209 mutex_init(&isec->lock);
210 INIT_LIST_HEAD(&isec->list);
211 isec->inode = inode;
212 isec->sid = SECINITSID_UNLABELED;
213 isec->sclass = SECCLASS_FILE;
214 isec->task_sid = sid;
215 inode->i_security = isec;
216
217 return 0;
218 }
219
220 static void inode_free_security(struct inode *inode)
221 {
222 struct inode_security_struct *isec = inode->i_security;
223 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
224
225 spin_lock(&sbsec->isec_lock);
226 if (!list_empty(&isec->list))
227 list_del_init(&isec->list);
228 spin_unlock(&sbsec->isec_lock);
229
230 inode->i_security = NULL;
231 kmem_cache_free(sel_inode_cache, isec);
232 }
233
234 static int file_alloc_security(struct file *file)
235 {
236 struct file_security_struct *fsec;
237 u32 sid = current_sid();
238
239 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
240 if (!fsec)
241 return -ENOMEM;
242
243 fsec->sid = sid;
244 fsec->fown_sid = sid;
245 file->f_security = fsec;
246
247 return 0;
248 }
249
250 static void file_free_security(struct file *file)
251 {
252 struct file_security_struct *fsec = file->f_security;
253 file->f_security = NULL;
254 kfree(fsec);
255 }
256
257 static int superblock_alloc_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec;
260
261 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
262 if (!sbsec)
263 return -ENOMEM;
264
265 mutex_init(&sbsec->lock);
266 INIT_LIST_HEAD(&sbsec->isec_head);
267 spin_lock_init(&sbsec->isec_lock);
268 sbsec->sb = sb;
269 sbsec->sid = SECINITSID_UNLABELED;
270 sbsec->def_sid = SECINITSID_FILE;
271 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
272 sb->s_security = sbsec;
273
274 return 0;
275 }
276
277 static void superblock_free_security(struct super_block *sb)
278 {
279 struct superblock_security_struct *sbsec = sb->s_security;
280 sb->s_security = NULL;
281 kfree(sbsec);
282 }
283
284 /* The file system's label must be initialized prior to use. */
285
286 static const char *labeling_behaviors[6] = {
287 "uses xattr",
288 "uses transition SIDs",
289 "uses task SIDs",
290 "uses genfs_contexts",
291 "not configured for labeling",
292 "uses mountpoint labeling",
293 };
294
295 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
296
297 static inline int inode_doinit(struct inode *inode)
298 {
299 return inode_doinit_with_dentry(inode, NULL);
300 }
301
302 enum {
303 Opt_error = -1,
304 Opt_context = 1,
305 Opt_fscontext = 2,
306 Opt_defcontext = 3,
307 Opt_rootcontext = 4,
308 Opt_labelsupport = 5,
309 };
310
311 static const match_table_t tokens = {
312 {Opt_context, CONTEXT_STR "%s"},
313 {Opt_fscontext, FSCONTEXT_STR "%s"},
314 {Opt_defcontext, DEFCONTEXT_STR "%s"},
315 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
316 {Opt_labelsupport, LABELSUPP_STR},
317 {Opt_error, NULL},
318 };
319
320 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
321
322 static int may_context_mount_sb_relabel(u32 sid,
323 struct superblock_security_struct *sbsec,
324 const struct cred *cred)
325 {
326 const struct task_security_struct *tsec = cred->security;
327 int rc;
328
329 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
330 FILESYSTEM__RELABELFROM, NULL);
331 if (rc)
332 return rc;
333
334 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
335 FILESYSTEM__RELABELTO, NULL);
336 return rc;
337 }
338
339 static int may_context_mount_inode_relabel(u32 sid,
340 struct superblock_security_struct *sbsec,
341 const struct cred *cred)
342 {
343 const struct task_security_struct *tsec = cred->security;
344 int rc;
345 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELFROM, NULL);
347 if (rc)
348 return rc;
349
350 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
351 FILESYSTEM__ASSOCIATE, NULL);
352 return rc;
353 }
354
355 static int sb_finish_set_opts(struct super_block *sb)
356 {
357 struct superblock_security_struct *sbsec = sb->s_security;
358 struct dentry *root = sb->s_root;
359 struct inode *root_inode = root->d_inode;
360 int rc = 0;
361
362 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
363 /* Make sure that the xattr handler exists and that no
364 error other than -ENODATA is returned by getxattr on
365 the root directory. -ENODATA is ok, as this may be
366 the first boot of the SELinux kernel before we have
367 assigned xattr values to the filesystem. */
368 if (!root_inode->i_op->getxattr) {
369 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
370 "xattr support\n", sb->s_id, sb->s_type->name);
371 rc = -EOPNOTSUPP;
372 goto out;
373 }
374 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
375 if (rc < 0 && rc != -ENODATA) {
376 if (rc == -EOPNOTSUPP)
377 printk(KERN_WARNING "SELinux: (dev %s, type "
378 "%s) has no security xattr handler\n",
379 sb->s_id, sb->s_type->name);
380 else
381 printk(KERN_WARNING "SELinux: (dev %s, type "
382 "%s) getxattr errno %d\n", sb->s_id,
383 sb->s_type->name, -rc);
384 goto out;
385 }
386 }
387
388 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
389
390 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
391 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
392 sb->s_id, sb->s_type->name);
393 else
394 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
395 sb->s_id, sb->s_type->name,
396 labeling_behaviors[sbsec->behavior-1]);
397
398 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
399 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
400 sbsec->behavior == SECURITY_FS_USE_NONE ||
401 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
402 sbsec->flags &= ~SE_SBLABELSUPP;
403
404 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
405 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
406 sbsec->flags |= SE_SBLABELSUPP;
407
408 /* Initialize the root inode. */
409 rc = inode_doinit_with_dentry(root_inode, root);
410
411 /* Initialize any other inodes associated with the superblock, e.g.
412 inodes created prior to initial policy load or inodes created
413 during get_sb by a pseudo filesystem that directly
414 populates itself. */
415 spin_lock(&sbsec->isec_lock);
416 next_inode:
417 if (!list_empty(&sbsec->isec_head)) {
418 struct inode_security_struct *isec =
419 list_entry(sbsec->isec_head.next,
420 struct inode_security_struct, list);
421 struct inode *inode = isec->inode;
422 spin_unlock(&sbsec->isec_lock);
423 inode = igrab(inode);
424 if (inode) {
425 if (!IS_PRIVATE(inode))
426 inode_doinit(inode);
427 iput(inode);
428 }
429 spin_lock(&sbsec->isec_lock);
430 list_del_init(&isec->list);
431 goto next_inode;
432 }
433 spin_unlock(&sbsec->isec_lock);
434 out:
435 return rc;
436 }
437
438 /*
439 * This function should allow an FS to ask what it's mount security
440 * options were so it can use those later for submounts, displaying
441 * mount options, or whatever.
442 */
443 static int selinux_get_mnt_opts(const struct super_block *sb,
444 struct security_mnt_opts *opts)
445 {
446 int rc = 0, i;
447 struct superblock_security_struct *sbsec = sb->s_security;
448 char *context = NULL;
449 u32 len;
450 char tmp;
451
452 security_init_mnt_opts(opts);
453
454 if (!(sbsec->flags & SE_SBINITIALIZED))
455 return -EINVAL;
456
457 if (!ss_initialized)
458 return -EINVAL;
459
460 tmp = sbsec->flags & SE_MNTMASK;
461 /* count the number of mount options for this sb */
462 for (i = 0; i < 8; i++) {
463 if (tmp & 0x01)
464 opts->num_mnt_opts++;
465 tmp >>= 1;
466 }
467 /* Check if the Label support flag is set */
468 if (sbsec->flags & SE_SBLABELSUPP)
469 opts->num_mnt_opts++;
470
471 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
472 if (!opts->mnt_opts) {
473 rc = -ENOMEM;
474 goto out_free;
475 }
476
477 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
478 if (!opts->mnt_opts_flags) {
479 rc = -ENOMEM;
480 goto out_free;
481 }
482
483 i = 0;
484 if (sbsec->flags & FSCONTEXT_MNT) {
485 rc = security_sid_to_context(sbsec->sid, &context, &len);
486 if (rc)
487 goto out_free;
488 opts->mnt_opts[i] = context;
489 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
490 }
491 if (sbsec->flags & CONTEXT_MNT) {
492 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
493 if (rc)
494 goto out_free;
495 opts->mnt_opts[i] = context;
496 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
497 }
498 if (sbsec->flags & DEFCONTEXT_MNT) {
499 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
500 if (rc)
501 goto out_free;
502 opts->mnt_opts[i] = context;
503 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
504 }
505 if (sbsec->flags & ROOTCONTEXT_MNT) {
506 struct inode *root = sbsec->sb->s_root->d_inode;
507 struct inode_security_struct *isec = root->i_security;
508
509 rc = security_sid_to_context(isec->sid, &context, &len);
510 if (rc)
511 goto out_free;
512 opts->mnt_opts[i] = context;
513 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
514 }
515 if (sbsec->flags & SE_SBLABELSUPP) {
516 opts->mnt_opts[i] = NULL;
517 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
518 }
519
520 BUG_ON(i != opts->num_mnt_opts);
521
522 return 0;
523
524 out_free:
525 security_free_mnt_opts(opts);
526 return rc;
527 }
528
529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
530 u32 old_sid, u32 new_sid)
531 {
532 char mnt_flags = sbsec->flags & SE_MNTMASK;
533
534 /* check if the old mount command had the same options */
535 if (sbsec->flags & SE_SBINITIALIZED)
536 if (!(sbsec->flags & flag) ||
537 (old_sid != new_sid))
538 return 1;
539
540 /* check if we were passed the same options twice,
541 * aka someone passed context=a,context=b
542 */
543 if (!(sbsec->flags & SE_SBINITIALIZED))
544 if (mnt_flags & flag)
545 return 1;
546 return 0;
547 }
548
549 /*
550 * Allow filesystems with binary mount data to explicitly set mount point
551 * labeling information.
552 */
553 static int selinux_set_mnt_opts(struct super_block *sb,
554 struct security_mnt_opts *opts)
555 {
556 const struct cred *cred = current_cred();
557 int rc = 0, i;
558 struct superblock_security_struct *sbsec = sb->s_security;
559 const char *name = sb->s_type->name;
560 struct inode *inode = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *root_isec = inode->i_security;
562 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
563 u32 defcontext_sid = 0;
564 char **mount_options = opts->mnt_opts;
565 int *flags = opts->mnt_opts_flags;
566 int num_opts = opts->num_mnt_opts;
567
568 mutex_lock(&sbsec->lock);
569
570 if (!ss_initialized) {
571 if (!num_opts) {
572 /* Defer initialization until selinux_complete_init,
573 after the initial policy is loaded and the security
574 server is ready to handle calls. */
575 goto out;
576 }
577 rc = -EINVAL;
578 printk(KERN_WARNING "SELinux: Unable to set superblock options "
579 "before the security server is initialized\n");
580 goto out;
581 }
582
583 /*
584 * Binary mount data FS will come through this function twice. Once
585 * from an explicit call and once from the generic calls from the vfs.
586 * Since the generic VFS calls will not contain any security mount data
587 * we need to skip the double mount verification.
588 *
589 * This does open a hole in which we will not notice if the first
590 * mount using this sb set explict options and a second mount using
591 * this sb does not set any security options. (The first options
592 * will be used for both mounts)
593 */
594 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
595 && (num_opts == 0))
596 goto out;
597
598 /*
599 * parse the mount options, check if they are valid sids.
600 * also check if someone is trying to mount the same sb more
601 * than once with different security options.
602 */
603 for (i = 0; i < num_opts; i++) {
604 u32 sid;
605
606 if (flags[i] == SE_SBLABELSUPP)
607 continue;
608 rc = security_context_to_sid(mount_options[i],
609 strlen(mount_options[i]), &sid);
610 if (rc) {
611 printk(KERN_WARNING "SELinux: security_context_to_sid"
612 "(%s) failed for (dev %s, type %s) errno=%d\n",
613 mount_options[i], sb->s_id, name, rc);
614 goto out;
615 }
616 switch (flags[i]) {
617 case FSCONTEXT_MNT:
618 fscontext_sid = sid;
619
620 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
621 fscontext_sid))
622 goto out_double_mount;
623
624 sbsec->flags |= FSCONTEXT_MNT;
625 break;
626 case CONTEXT_MNT:
627 context_sid = sid;
628
629 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
630 context_sid))
631 goto out_double_mount;
632
633 sbsec->flags |= CONTEXT_MNT;
634 break;
635 case ROOTCONTEXT_MNT:
636 rootcontext_sid = sid;
637
638 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
639 rootcontext_sid))
640 goto out_double_mount;
641
642 sbsec->flags |= ROOTCONTEXT_MNT;
643
644 break;
645 case DEFCONTEXT_MNT:
646 defcontext_sid = sid;
647
648 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
649 defcontext_sid))
650 goto out_double_mount;
651
652 sbsec->flags |= DEFCONTEXT_MNT;
653
654 break;
655 default:
656 rc = -EINVAL;
657 goto out;
658 }
659 }
660
661 if (sbsec->flags & SE_SBINITIALIZED) {
662 /* previously mounted with options, but not on this attempt? */
663 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
664 goto out_double_mount;
665 rc = 0;
666 goto out;
667 }
668
669 if (strcmp(sb->s_type->name, "proc") == 0)
670 sbsec->flags |= SE_SBPROC;
671
672 /* Determine the labeling behavior to use for this filesystem type. */
673 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
674 if (rc) {
675 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
676 __func__, sb->s_type->name, rc);
677 goto out;
678 }
679
680 /* sets the context of the superblock for the fs being mounted. */
681 if (fscontext_sid) {
682 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
683 if (rc)
684 goto out;
685
686 sbsec->sid = fscontext_sid;
687 }
688
689 /*
690 * Switch to using mount point labeling behavior.
691 * sets the label used on all file below the mountpoint, and will set
692 * the superblock context if not already set.
693 */
694 if (context_sid) {
695 if (!fscontext_sid) {
696 rc = may_context_mount_sb_relabel(context_sid, sbsec,
697 cred);
698 if (rc)
699 goto out;
700 sbsec->sid = context_sid;
701 } else {
702 rc = may_context_mount_inode_relabel(context_sid, sbsec,
703 cred);
704 if (rc)
705 goto out;
706 }
707 if (!rootcontext_sid)
708 rootcontext_sid = context_sid;
709
710 sbsec->mntpoint_sid = context_sid;
711 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
712 }
713
714 if (rootcontext_sid) {
715 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
716 cred);
717 if (rc)
718 goto out;
719
720 root_isec->sid = rootcontext_sid;
721 root_isec->initialized = 1;
722 }
723
724 if (defcontext_sid) {
725 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
726 rc = -EINVAL;
727 printk(KERN_WARNING "SELinux: defcontext option is "
728 "invalid for this filesystem type\n");
729 goto out;
730 }
731
732 if (defcontext_sid != sbsec->def_sid) {
733 rc = may_context_mount_inode_relabel(defcontext_sid,
734 sbsec, cred);
735 if (rc)
736 goto out;
737 }
738
739 sbsec->def_sid = defcontext_sid;
740 }
741
742 rc = sb_finish_set_opts(sb);
743 out:
744 mutex_unlock(&sbsec->lock);
745 return rc;
746 out_double_mount:
747 rc = -EINVAL;
748 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
749 "security settings for (dev %s, type %s)\n", sb->s_id, name);
750 goto out;
751 }
752
753 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
754 struct super_block *newsb)
755 {
756 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
757 struct superblock_security_struct *newsbsec = newsb->s_security;
758
759 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
760 int set_context = (oldsbsec->flags & CONTEXT_MNT);
761 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
762
763 /*
764 * if the parent was able to be mounted it clearly had no special lsm
765 * mount options. thus we can safely deal with this superblock later
766 */
767 if (!ss_initialized)
768 return;
769
770 /* how can we clone if the old one wasn't set up?? */
771 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
772
773 /* if fs is reusing a sb, just let its options stand... */
774 if (newsbsec->flags & SE_SBINITIALIZED)
775 return;
776
777 mutex_lock(&newsbsec->lock);
778
779 newsbsec->flags = oldsbsec->flags;
780
781 newsbsec->sid = oldsbsec->sid;
782 newsbsec->def_sid = oldsbsec->def_sid;
783 newsbsec->behavior = oldsbsec->behavior;
784
785 if (set_context) {
786 u32 sid = oldsbsec->mntpoint_sid;
787
788 if (!set_fscontext)
789 newsbsec->sid = sid;
790 if (!set_rootcontext) {
791 struct inode *newinode = newsb->s_root->d_inode;
792 struct inode_security_struct *newisec = newinode->i_security;
793 newisec->sid = sid;
794 }
795 newsbsec->mntpoint_sid = sid;
796 }
797 if (set_rootcontext) {
798 const struct inode *oldinode = oldsb->s_root->d_inode;
799 const struct inode_security_struct *oldisec = oldinode->i_security;
800 struct inode *newinode = newsb->s_root->d_inode;
801 struct inode_security_struct *newisec = newinode->i_security;
802
803 newisec->sid = oldisec->sid;
804 }
805
806 sb_finish_set_opts(newsb);
807 mutex_unlock(&newsbsec->lock);
808 }
809
810 static int selinux_parse_opts_str(char *options,
811 struct security_mnt_opts *opts)
812 {
813 char *p;
814 char *context = NULL, *defcontext = NULL;
815 char *fscontext = NULL, *rootcontext = NULL;
816 int rc, num_mnt_opts = 0;
817
818 opts->num_mnt_opts = 0;
819
820 /* Standard string-based options. */
821 while ((p = strsep(&options, "|")) != NULL) {
822 int token;
823 substring_t args[MAX_OPT_ARGS];
824
825 if (!*p)
826 continue;
827
828 token = match_token(p, tokens, args);
829
830 switch (token) {
831 case Opt_context:
832 if (context || defcontext) {
833 rc = -EINVAL;
834 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
835 goto out_err;
836 }
837 context = match_strdup(&args[0]);
838 if (!context) {
839 rc = -ENOMEM;
840 goto out_err;
841 }
842 break;
843
844 case Opt_fscontext:
845 if (fscontext) {
846 rc = -EINVAL;
847 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
848 goto out_err;
849 }
850 fscontext = match_strdup(&args[0]);
851 if (!fscontext) {
852 rc = -ENOMEM;
853 goto out_err;
854 }
855 break;
856
857 case Opt_rootcontext:
858 if (rootcontext) {
859 rc = -EINVAL;
860 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
861 goto out_err;
862 }
863 rootcontext = match_strdup(&args[0]);
864 if (!rootcontext) {
865 rc = -ENOMEM;
866 goto out_err;
867 }
868 break;
869
870 case Opt_defcontext:
871 if (context || defcontext) {
872 rc = -EINVAL;
873 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
874 goto out_err;
875 }
876 defcontext = match_strdup(&args[0]);
877 if (!defcontext) {
878 rc = -ENOMEM;
879 goto out_err;
880 }
881 break;
882 case Opt_labelsupport:
883 break;
884 default:
885 rc = -EINVAL;
886 printk(KERN_WARNING "SELinux: unknown mount option\n");
887 goto out_err;
888
889 }
890 }
891
892 rc = -ENOMEM;
893 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
894 if (!opts->mnt_opts)
895 goto out_err;
896
897 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
898 if (!opts->mnt_opts_flags) {
899 kfree(opts->mnt_opts);
900 goto out_err;
901 }
902
903 if (fscontext) {
904 opts->mnt_opts[num_mnt_opts] = fscontext;
905 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
906 }
907 if (context) {
908 opts->mnt_opts[num_mnt_opts] = context;
909 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
910 }
911 if (rootcontext) {
912 opts->mnt_opts[num_mnt_opts] = rootcontext;
913 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
914 }
915 if (defcontext) {
916 opts->mnt_opts[num_mnt_opts] = defcontext;
917 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
918 }
919
920 opts->num_mnt_opts = num_mnt_opts;
921 return 0;
922
923 out_err:
924 kfree(context);
925 kfree(defcontext);
926 kfree(fscontext);
927 kfree(rootcontext);
928 return rc;
929 }
930 /*
931 * string mount options parsing and call set the sbsec
932 */
933 static int superblock_doinit(struct super_block *sb, void *data)
934 {
935 int rc = 0;
936 char *options = data;
937 struct security_mnt_opts opts;
938
939 security_init_mnt_opts(&opts);
940
941 if (!data)
942 goto out;
943
944 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
945
946 rc = selinux_parse_opts_str(options, &opts);
947 if (rc)
948 goto out_err;
949
950 out:
951 rc = selinux_set_mnt_opts(sb, &opts);
952
953 out_err:
954 security_free_mnt_opts(&opts);
955 return rc;
956 }
957
958 static void selinux_write_opts(struct seq_file *m,
959 struct security_mnt_opts *opts)
960 {
961 int i;
962 char *prefix;
963
964 for (i = 0; i < opts->num_mnt_opts; i++) {
965 char *has_comma;
966
967 if (opts->mnt_opts[i])
968 has_comma = strchr(opts->mnt_opts[i], ',');
969 else
970 has_comma = NULL;
971
972 switch (opts->mnt_opts_flags[i]) {
973 case CONTEXT_MNT:
974 prefix = CONTEXT_STR;
975 break;
976 case FSCONTEXT_MNT:
977 prefix = FSCONTEXT_STR;
978 break;
979 case ROOTCONTEXT_MNT:
980 prefix = ROOTCONTEXT_STR;
981 break;
982 case DEFCONTEXT_MNT:
983 prefix = DEFCONTEXT_STR;
984 break;
985 case SE_SBLABELSUPP:
986 seq_putc(m, ',');
987 seq_puts(m, LABELSUPP_STR);
988 continue;
989 default:
990 BUG();
991 return;
992 };
993 /* we need a comma before each option */
994 seq_putc(m, ',');
995 seq_puts(m, prefix);
996 if (has_comma)
997 seq_putc(m, '\"');
998 seq_puts(m, opts->mnt_opts[i]);
999 if (has_comma)
1000 seq_putc(m, '\"');
1001 }
1002 }
1003
1004 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1005 {
1006 struct security_mnt_opts opts;
1007 int rc;
1008
1009 rc = selinux_get_mnt_opts(sb, &opts);
1010 if (rc) {
1011 /* before policy load we may get EINVAL, don't show anything */
1012 if (rc == -EINVAL)
1013 rc = 0;
1014 return rc;
1015 }
1016
1017 selinux_write_opts(m, &opts);
1018
1019 security_free_mnt_opts(&opts);
1020
1021 return rc;
1022 }
1023
1024 static inline u16 inode_mode_to_security_class(umode_t mode)
1025 {
1026 switch (mode & S_IFMT) {
1027 case S_IFSOCK:
1028 return SECCLASS_SOCK_FILE;
1029 case S_IFLNK:
1030 return SECCLASS_LNK_FILE;
1031 case S_IFREG:
1032 return SECCLASS_FILE;
1033 case S_IFBLK:
1034 return SECCLASS_BLK_FILE;
1035 case S_IFDIR:
1036 return SECCLASS_DIR;
1037 case S_IFCHR:
1038 return SECCLASS_CHR_FILE;
1039 case S_IFIFO:
1040 return SECCLASS_FIFO_FILE;
1041
1042 }
1043
1044 return SECCLASS_FILE;
1045 }
1046
1047 static inline int default_protocol_stream(int protocol)
1048 {
1049 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1050 }
1051
1052 static inline int default_protocol_dgram(int protocol)
1053 {
1054 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1055 }
1056
1057 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1058 {
1059 switch (family) {
1060 case PF_UNIX:
1061 switch (type) {
1062 case SOCK_STREAM:
1063 case SOCK_SEQPACKET:
1064 return SECCLASS_UNIX_STREAM_SOCKET;
1065 case SOCK_DGRAM:
1066 return SECCLASS_UNIX_DGRAM_SOCKET;
1067 }
1068 break;
1069 case PF_INET:
1070 case PF_INET6:
1071 switch (type) {
1072 case SOCK_STREAM:
1073 if (default_protocol_stream(protocol))
1074 return SECCLASS_TCP_SOCKET;
1075 else
1076 return SECCLASS_RAWIP_SOCKET;
1077 case SOCK_DGRAM:
1078 if (default_protocol_dgram(protocol))
1079 return SECCLASS_UDP_SOCKET;
1080 else
1081 return SECCLASS_RAWIP_SOCKET;
1082 case SOCK_DCCP:
1083 return SECCLASS_DCCP_SOCKET;
1084 default:
1085 return SECCLASS_RAWIP_SOCKET;
1086 }
1087 break;
1088 case PF_NETLINK:
1089 switch (protocol) {
1090 case NETLINK_ROUTE:
1091 return SECCLASS_NETLINK_ROUTE_SOCKET;
1092 case NETLINK_FIREWALL:
1093 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1094 case NETLINK_SOCK_DIAG:
1095 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1096 case NETLINK_NFLOG:
1097 return SECCLASS_NETLINK_NFLOG_SOCKET;
1098 case NETLINK_XFRM:
1099 return SECCLASS_NETLINK_XFRM_SOCKET;
1100 case NETLINK_SELINUX:
1101 return SECCLASS_NETLINK_SELINUX_SOCKET;
1102 case NETLINK_AUDIT:
1103 return SECCLASS_NETLINK_AUDIT_SOCKET;
1104 case NETLINK_IP6_FW:
1105 return SECCLASS_NETLINK_IP6FW_SOCKET;
1106 case NETLINK_DNRTMSG:
1107 return SECCLASS_NETLINK_DNRT_SOCKET;
1108 case NETLINK_KOBJECT_UEVENT:
1109 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1110 default:
1111 return SECCLASS_NETLINK_SOCKET;
1112 }
1113 case PF_PACKET:
1114 return SECCLASS_PACKET_SOCKET;
1115 case PF_KEY:
1116 return SECCLASS_KEY_SOCKET;
1117 case PF_APPLETALK:
1118 return SECCLASS_APPLETALK_SOCKET;
1119 }
1120
1121 return SECCLASS_SOCKET;
1122 }
1123
1124 #ifdef CONFIG_PROC_FS
1125 static int selinux_proc_get_sid(struct dentry *dentry,
1126 u16 tclass,
1127 u32 *sid)
1128 {
1129 int rc;
1130 char *buffer, *path;
1131
1132 buffer = (char *)__get_free_page(GFP_KERNEL);
1133 if (!buffer)
1134 return -ENOMEM;
1135
1136 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1137 if (IS_ERR(path))
1138 rc = PTR_ERR(path);
1139 else {
1140 /* each process gets a /proc/PID/ entry. Strip off the
1141 * PID part to get a valid selinux labeling.
1142 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1143 while (path[1] >= '0' && path[1] <= '9') {
1144 path[1] = '/';
1145 path++;
1146 }
1147 rc = security_genfs_sid("proc", path, tclass, sid);
1148 }
1149 free_page((unsigned long)buffer);
1150 return rc;
1151 }
1152 #else
1153 static int selinux_proc_get_sid(struct dentry *dentry,
1154 u16 tclass,
1155 u32 *sid)
1156 {
1157 return -EINVAL;
1158 }
1159 #endif
1160
1161 /* The inode's security attributes must be initialized before first use. */
1162 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1163 {
1164 struct superblock_security_struct *sbsec = NULL;
1165 struct inode_security_struct *isec = inode->i_security;
1166 u32 sid;
1167 struct dentry *dentry;
1168 #define INITCONTEXTLEN 255
1169 char *context = NULL;
1170 unsigned len = 0;
1171 int rc = 0;
1172
1173 if (isec->initialized)
1174 goto out;
1175
1176 mutex_lock(&isec->lock);
1177 if (isec->initialized)
1178 goto out_unlock;
1179
1180 sbsec = inode->i_sb->s_security;
1181 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1182 /* Defer initialization until selinux_complete_init,
1183 after the initial policy is loaded and the security
1184 server is ready to handle calls. */
1185 spin_lock(&sbsec->isec_lock);
1186 if (list_empty(&isec->list))
1187 list_add(&isec->list, &sbsec->isec_head);
1188 spin_unlock(&sbsec->isec_lock);
1189 goto out_unlock;
1190 }
1191
1192 switch (sbsec->behavior) {
1193 case SECURITY_FS_USE_XATTR:
1194 if (!inode->i_op->getxattr) {
1195 isec->sid = sbsec->def_sid;
1196 break;
1197 }
1198
1199 /* Need a dentry, since the xattr API requires one.
1200 Life would be simpler if we could just pass the inode. */
1201 if (opt_dentry) {
1202 /* Called from d_instantiate or d_splice_alias. */
1203 dentry = dget(opt_dentry);
1204 } else {
1205 /* Called from selinux_complete_init, try to find a dentry. */
1206 dentry = d_find_alias(inode);
1207 }
1208 if (!dentry) {
1209 /*
1210 * this is can be hit on boot when a file is accessed
1211 * before the policy is loaded. When we load policy we
1212 * may find inodes that have no dentry on the
1213 * sbsec->isec_head list. No reason to complain as these
1214 * will get fixed up the next time we go through
1215 * inode_doinit with a dentry, before these inodes could
1216 * be used again by userspace.
1217 */
1218 goto out_unlock;
1219 }
1220
1221 len = INITCONTEXTLEN;
1222 context = kmalloc(len+1, GFP_NOFS);
1223 if (!context) {
1224 rc = -ENOMEM;
1225 dput(dentry);
1226 goto out_unlock;
1227 }
1228 context[len] = '\0';
1229 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1230 context, len);
1231 if (rc == -ERANGE) {
1232 kfree(context);
1233
1234 /* Need a larger buffer. Query for the right size. */
1235 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1236 NULL, 0);
1237 if (rc < 0) {
1238 dput(dentry);
1239 goto out_unlock;
1240 }
1241 len = rc;
1242 context = kmalloc(len+1, GFP_NOFS);
1243 if (!context) {
1244 rc = -ENOMEM;
1245 dput(dentry);
1246 goto out_unlock;
1247 }
1248 context[len] = '\0';
1249 rc = inode->i_op->getxattr(dentry,
1250 XATTR_NAME_SELINUX,
1251 context, len);
1252 }
1253 dput(dentry);
1254 if (rc < 0) {
1255 if (rc != -ENODATA) {
1256 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1257 "%d for dev=%s ino=%ld\n", __func__,
1258 -rc, inode->i_sb->s_id, inode->i_ino);
1259 kfree(context);
1260 goto out_unlock;
1261 }
1262 /* Map ENODATA to the default file SID */
1263 sid = sbsec->def_sid;
1264 rc = 0;
1265 } else {
1266 rc = security_context_to_sid_default(context, rc, &sid,
1267 sbsec->def_sid,
1268 GFP_NOFS);
1269 if (rc) {
1270 char *dev = inode->i_sb->s_id;
1271 unsigned long ino = inode->i_ino;
1272
1273 if (rc == -EINVAL) {
1274 if (printk_ratelimit())
1275 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1276 "context=%s. This indicates you may need to relabel the inode or the "
1277 "filesystem in question.\n", ino, dev, context);
1278 } else {
1279 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1280 "returned %d for dev=%s ino=%ld\n",
1281 __func__, context, -rc, dev, ino);
1282 }
1283 kfree(context);
1284 /* Leave with the unlabeled SID */
1285 rc = 0;
1286 break;
1287 }
1288 }
1289 kfree(context);
1290 isec->sid = sid;
1291 break;
1292 case SECURITY_FS_USE_TASK:
1293 isec->sid = isec->task_sid;
1294 break;
1295 case SECURITY_FS_USE_TRANS:
1296 /* Default to the fs SID. */
1297 isec->sid = sbsec->sid;
1298
1299 /* Try to obtain a transition SID. */
1300 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1301 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1302 isec->sclass, NULL, &sid);
1303 if (rc)
1304 goto out_unlock;
1305 isec->sid = sid;
1306 break;
1307 case SECURITY_FS_USE_MNTPOINT:
1308 isec->sid = sbsec->mntpoint_sid;
1309 break;
1310 default:
1311 /* Default to the fs superblock SID. */
1312 isec->sid = sbsec->sid;
1313
1314 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1315 if (opt_dentry) {
1316 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1317 rc = selinux_proc_get_sid(opt_dentry,
1318 isec->sclass,
1319 &sid);
1320 if (rc)
1321 goto out_unlock;
1322 isec->sid = sid;
1323 }
1324 }
1325 break;
1326 }
1327
1328 isec->initialized = 1;
1329
1330 out_unlock:
1331 mutex_unlock(&isec->lock);
1332 out:
1333 if (isec->sclass == SECCLASS_FILE)
1334 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1335 return rc;
1336 }
1337
1338 /* Convert a Linux signal to an access vector. */
1339 static inline u32 signal_to_av(int sig)
1340 {
1341 u32 perm = 0;
1342
1343 switch (sig) {
1344 case SIGCHLD:
1345 /* Commonly granted from child to parent. */
1346 perm = PROCESS__SIGCHLD;
1347 break;
1348 case SIGKILL:
1349 /* Cannot be caught or ignored */
1350 perm = PROCESS__SIGKILL;
1351 break;
1352 case SIGSTOP:
1353 /* Cannot be caught or ignored */
1354 perm = PROCESS__SIGSTOP;
1355 break;
1356 default:
1357 /* All other signals. */
1358 perm = PROCESS__SIGNAL;
1359 break;
1360 }
1361
1362 return perm;
1363 }
1364
1365 /*
1366 * Check permission between a pair of credentials
1367 * fork check, ptrace check, etc.
1368 */
1369 static int cred_has_perm(const struct cred *actor,
1370 const struct cred *target,
1371 u32 perms)
1372 {
1373 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1374
1375 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1376 }
1377
1378 /*
1379 * Check permission between a pair of tasks, e.g. signal checks,
1380 * fork check, ptrace check, etc.
1381 * tsk1 is the actor and tsk2 is the target
1382 * - this uses the default subjective creds of tsk1
1383 */
1384 static int task_has_perm(const struct task_struct *tsk1,
1385 const struct task_struct *tsk2,
1386 u32 perms)
1387 {
1388 const struct task_security_struct *__tsec1, *__tsec2;
1389 u32 sid1, sid2;
1390
1391 rcu_read_lock();
1392 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1393 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1394 rcu_read_unlock();
1395 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1396 }
1397
1398 /*
1399 * Check permission between current and another task, e.g. signal checks,
1400 * fork check, ptrace check, etc.
1401 * current is the actor and tsk2 is the target
1402 * - this uses current's subjective creds
1403 */
1404 static int current_has_perm(const struct task_struct *tsk,
1405 u32 perms)
1406 {
1407 u32 sid, tsid;
1408
1409 sid = current_sid();
1410 tsid = task_sid(tsk);
1411 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1412 }
1413
1414 #if CAP_LAST_CAP > 63
1415 #error Fix SELinux to handle capabilities > 63.
1416 #endif
1417
1418 /* Check whether a task is allowed to use a capability. */
1419 static int cred_has_capability(const struct cred *cred,
1420 int cap, int audit)
1421 {
1422 struct common_audit_data ad;
1423 struct selinux_audit_data sad = {0,};
1424 struct av_decision avd;
1425 u16 sclass;
1426 u32 sid = cred_sid(cred);
1427 u32 av = CAP_TO_MASK(cap);
1428 int rc;
1429
1430 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1431 ad.selinux_audit_data = &sad;
1432 ad.tsk = current;
1433 ad.u.cap = cap;
1434
1435 switch (CAP_TO_INDEX(cap)) {
1436 case 0:
1437 sclass = SECCLASS_CAPABILITY;
1438 break;
1439 case 1:
1440 sclass = SECCLASS_CAPABILITY2;
1441 break;
1442 default:
1443 printk(KERN_ERR
1444 "SELinux: out of range capability %d\n", cap);
1445 BUG();
1446 return -EINVAL;
1447 }
1448
1449 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1450 if (audit == SECURITY_CAP_AUDIT) {
1451 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1452 if (rc2)
1453 return rc2;
1454 }
1455 return rc;
1456 }
1457
1458 /* Check whether a task is allowed to use a system operation. */
1459 static int task_has_system(struct task_struct *tsk,
1460 u32 perms)
1461 {
1462 u32 sid = task_sid(tsk);
1463
1464 return avc_has_perm(sid, SECINITSID_KERNEL,
1465 SECCLASS_SYSTEM, perms, NULL);
1466 }
1467
1468 /* Check whether a task has a particular permission to an inode.
1469 The 'adp' parameter is optional and allows other audit
1470 data to be passed (e.g. the dentry). */
1471 static int inode_has_perm(const struct cred *cred,
1472 struct inode *inode,
1473 u32 perms,
1474 struct common_audit_data *adp,
1475 unsigned flags)
1476 {
1477 struct inode_security_struct *isec;
1478 u32 sid;
1479
1480 validate_creds(cred);
1481
1482 if (unlikely(IS_PRIVATE(inode)))
1483 return 0;
1484
1485 sid = cred_sid(cred);
1486 isec = inode->i_security;
1487
1488 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1489 }
1490
1491 static int inode_has_perm_noadp(const struct cred *cred,
1492 struct inode *inode,
1493 u32 perms,
1494 unsigned flags)
1495 {
1496 struct common_audit_data ad;
1497 struct selinux_audit_data sad = {0,};
1498
1499 COMMON_AUDIT_DATA_INIT(&ad, INODE);
1500 ad.u.inode = inode;
1501 ad.selinux_audit_data = &sad;
1502 return inode_has_perm(cred, inode, perms, &ad, flags);
1503 }
1504
1505 /* Same as inode_has_perm, but pass explicit audit data containing
1506 the dentry to help the auditing code to more easily generate the
1507 pathname if needed. */
1508 static inline int dentry_has_perm(const struct cred *cred,
1509 struct dentry *dentry,
1510 u32 av)
1511 {
1512 struct inode *inode = dentry->d_inode;
1513 struct common_audit_data ad;
1514 struct selinux_audit_data sad = {0,};
1515
1516 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1517 ad.u.dentry = dentry;
1518 ad.selinux_audit_data = &sad;
1519 return inode_has_perm(cred, inode, av, &ad, 0);
1520 }
1521
1522 /* Same as inode_has_perm, but pass explicit audit data containing
1523 the path to help the auditing code to more easily generate the
1524 pathname if needed. */
1525 static inline int path_has_perm(const struct cred *cred,
1526 struct path *path,
1527 u32 av)
1528 {
1529 struct inode *inode = path->dentry->d_inode;
1530 struct common_audit_data ad;
1531 struct selinux_audit_data sad = {0,};
1532
1533 COMMON_AUDIT_DATA_INIT(&ad, PATH);
1534 ad.u.path = *path;
1535 ad.selinux_audit_data = &sad;
1536 return inode_has_perm(cred, inode, av, &ad, 0);
1537 }
1538
1539 /* Check whether a task can use an open file descriptor to
1540 access an inode in a given way. Check access to the
1541 descriptor itself, and then use dentry_has_perm to
1542 check a particular permission to the file.
1543 Access to the descriptor is implicitly granted if it
1544 has the same SID as the process. If av is zero, then
1545 access to the file is not checked, e.g. for cases
1546 where only the descriptor is affected like seek. */
1547 static int file_has_perm(const struct cred *cred,
1548 struct file *file,
1549 u32 av)
1550 {
1551 struct file_security_struct *fsec = file->f_security;
1552 struct inode *inode = file->f_path.dentry->d_inode;
1553 struct common_audit_data ad;
1554 struct selinux_audit_data sad = {0,};
1555 u32 sid = cred_sid(cred);
1556 int rc;
1557
1558 COMMON_AUDIT_DATA_INIT(&ad, PATH);
1559 ad.u.path = file->f_path;
1560 ad.selinux_audit_data = &sad;
1561
1562 if (sid != fsec->sid) {
1563 rc = avc_has_perm(sid, fsec->sid,
1564 SECCLASS_FD,
1565 FD__USE,
1566 &ad);
1567 if (rc)
1568 goto out;
1569 }
1570
1571 /* av is zero if only checking access to the descriptor. */
1572 rc = 0;
1573 if (av)
1574 rc = inode_has_perm(cred, inode, av, &ad, 0);
1575
1576 out:
1577 return rc;
1578 }
1579
1580 /* Check whether a task can create a file. */
1581 static int may_create(struct inode *dir,
1582 struct dentry *dentry,
1583 u16 tclass)
1584 {
1585 const struct task_security_struct *tsec = current_security();
1586 struct inode_security_struct *dsec;
1587 struct superblock_security_struct *sbsec;
1588 u32 sid, newsid;
1589 struct common_audit_data ad;
1590 struct selinux_audit_data sad = {0,};
1591 int rc;
1592
1593 dsec = dir->i_security;
1594 sbsec = dir->i_sb->s_security;
1595
1596 sid = tsec->sid;
1597 newsid = tsec->create_sid;
1598
1599 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1600 ad.u.dentry = dentry;
1601 ad.selinux_audit_data = &sad;
1602
1603 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1604 DIR__ADD_NAME | DIR__SEARCH,
1605 &ad);
1606 if (rc)
1607 return rc;
1608
1609 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1610 rc = security_transition_sid(sid, dsec->sid, tclass,
1611 &dentry->d_name, &newsid);
1612 if (rc)
1613 return rc;
1614 }
1615
1616 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1617 if (rc)
1618 return rc;
1619
1620 return avc_has_perm(newsid, sbsec->sid,
1621 SECCLASS_FILESYSTEM,
1622 FILESYSTEM__ASSOCIATE, &ad);
1623 }
1624
1625 /* Check whether a task can create a key. */
1626 static int may_create_key(u32 ksid,
1627 struct task_struct *ctx)
1628 {
1629 u32 sid = task_sid(ctx);
1630
1631 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1632 }
1633
1634 #define MAY_LINK 0
1635 #define MAY_UNLINK 1
1636 #define MAY_RMDIR 2
1637
1638 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1639 static int may_link(struct inode *dir,
1640 struct dentry *dentry,
1641 int kind)
1642
1643 {
1644 struct inode_security_struct *dsec, *isec;
1645 struct common_audit_data ad;
1646 struct selinux_audit_data sad = {0,};
1647 u32 sid = current_sid();
1648 u32 av;
1649 int rc;
1650
1651 dsec = dir->i_security;
1652 isec = dentry->d_inode->i_security;
1653
1654 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1655 ad.u.dentry = dentry;
1656 ad.selinux_audit_data = &sad;
1657
1658 av = DIR__SEARCH;
1659 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1660 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1661 if (rc)
1662 return rc;
1663
1664 switch (kind) {
1665 case MAY_LINK:
1666 av = FILE__LINK;
1667 break;
1668 case MAY_UNLINK:
1669 av = FILE__UNLINK;
1670 break;
1671 case MAY_RMDIR:
1672 av = DIR__RMDIR;
1673 break;
1674 default:
1675 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1676 __func__, kind);
1677 return 0;
1678 }
1679
1680 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1681 return rc;
1682 }
1683
1684 static inline int may_rename(struct inode *old_dir,
1685 struct dentry *old_dentry,
1686 struct inode *new_dir,
1687 struct dentry *new_dentry)
1688 {
1689 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1690 struct common_audit_data ad;
1691 struct selinux_audit_data sad = {0,};
1692 u32 sid = current_sid();
1693 u32 av;
1694 int old_is_dir, new_is_dir;
1695 int rc;
1696
1697 old_dsec = old_dir->i_security;
1698 old_isec = old_dentry->d_inode->i_security;
1699 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1700 new_dsec = new_dir->i_security;
1701
1702 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1703 ad.selinux_audit_data = &sad;
1704
1705 ad.u.dentry = old_dentry;
1706 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1707 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1708 if (rc)
1709 return rc;
1710 rc = avc_has_perm(sid, old_isec->sid,
1711 old_isec->sclass, FILE__RENAME, &ad);
1712 if (rc)
1713 return rc;
1714 if (old_is_dir && new_dir != old_dir) {
1715 rc = avc_has_perm(sid, old_isec->sid,
1716 old_isec->sclass, DIR__REPARENT, &ad);
1717 if (rc)
1718 return rc;
1719 }
1720
1721 ad.u.dentry = new_dentry;
1722 av = DIR__ADD_NAME | DIR__SEARCH;
1723 if (new_dentry->d_inode)
1724 av |= DIR__REMOVE_NAME;
1725 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1726 if (rc)
1727 return rc;
1728 if (new_dentry->d_inode) {
1729 new_isec = new_dentry->d_inode->i_security;
1730 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1731 rc = avc_has_perm(sid, new_isec->sid,
1732 new_isec->sclass,
1733 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1734 if (rc)
1735 return rc;
1736 }
1737
1738 return 0;
1739 }
1740
1741 /* Check whether a task can perform a filesystem operation. */
1742 static int superblock_has_perm(const struct cred *cred,
1743 struct super_block *sb,
1744 u32 perms,
1745 struct common_audit_data *ad)
1746 {
1747 struct superblock_security_struct *sbsec;
1748 u32 sid = cred_sid(cred);
1749
1750 sbsec = sb->s_security;
1751 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1752 }
1753
1754 /* Convert a Linux mode and permission mask to an access vector. */
1755 static inline u32 file_mask_to_av(int mode, int mask)
1756 {
1757 u32 av = 0;
1758
1759 if (!S_ISDIR(mode)) {
1760 if (mask & MAY_EXEC)
1761 av |= FILE__EXECUTE;
1762 if (mask & MAY_READ)
1763 av |= FILE__READ;
1764
1765 if (mask & MAY_APPEND)
1766 av |= FILE__APPEND;
1767 else if (mask & MAY_WRITE)
1768 av |= FILE__WRITE;
1769
1770 } else {
1771 if (mask & MAY_EXEC)
1772 av |= DIR__SEARCH;
1773 if (mask & MAY_WRITE)
1774 av |= DIR__WRITE;
1775 if (mask & MAY_READ)
1776 av |= DIR__READ;
1777 }
1778
1779 return av;
1780 }
1781
1782 /* Convert a Linux file to an access vector. */
1783 static inline u32 file_to_av(struct file *file)
1784 {
1785 u32 av = 0;
1786
1787 if (file->f_mode & FMODE_READ)
1788 av |= FILE__READ;
1789 if (file->f_mode & FMODE_WRITE) {
1790 if (file->f_flags & O_APPEND)
1791 av |= FILE__APPEND;
1792 else
1793 av |= FILE__WRITE;
1794 }
1795 if (!av) {
1796 /*
1797 * Special file opened with flags 3 for ioctl-only use.
1798 */
1799 av = FILE__IOCTL;
1800 }
1801
1802 return av;
1803 }
1804
1805 /*
1806 * Convert a file to an access vector and include the correct open
1807 * open permission.
1808 */
1809 static inline u32 open_file_to_av(struct file *file)
1810 {
1811 u32 av = file_to_av(file);
1812
1813 if (selinux_policycap_openperm)
1814 av |= FILE__OPEN;
1815
1816 return av;
1817 }
1818
1819 /* Hook functions begin here. */
1820
1821 static int selinux_ptrace_access_check(struct task_struct *child,
1822 unsigned int mode)
1823 {
1824 int rc;
1825
1826 rc = cap_ptrace_access_check(child, mode);
1827 if (rc)
1828 return rc;
1829
1830 if (mode & PTRACE_MODE_READ) {
1831 u32 sid = current_sid();
1832 u32 csid = task_sid(child);
1833 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1834 }
1835
1836 return current_has_perm(child, PROCESS__PTRACE);
1837 }
1838
1839 static int selinux_ptrace_traceme(struct task_struct *parent)
1840 {
1841 int rc;
1842
1843 rc = cap_ptrace_traceme(parent);
1844 if (rc)
1845 return rc;
1846
1847 return task_has_perm(parent, current, PROCESS__PTRACE);
1848 }
1849
1850 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1851 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1852 {
1853 int error;
1854
1855 error = current_has_perm(target, PROCESS__GETCAP);
1856 if (error)
1857 return error;
1858
1859 return cap_capget(target, effective, inheritable, permitted);
1860 }
1861
1862 static int selinux_capset(struct cred *new, const struct cred *old,
1863 const kernel_cap_t *effective,
1864 const kernel_cap_t *inheritable,
1865 const kernel_cap_t *permitted)
1866 {
1867 int error;
1868
1869 error = cap_capset(new, old,
1870 effective, inheritable, permitted);
1871 if (error)
1872 return error;
1873
1874 return cred_has_perm(old, new, PROCESS__SETCAP);
1875 }
1876
1877 /*
1878 * (This comment used to live with the selinux_task_setuid hook,
1879 * which was removed).
1880 *
1881 * Since setuid only affects the current process, and since the SELinux
1882 * controls are not based on the Linux identity attributes, SELinux does not
1883 * need to control this operation. However, SELinux does control the use of
1884 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1885 */
1886
1887 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1888 int cap, int audit)
1889 {
1890 int rc;
1891
1892 rc = cap_capable(cred, ns, cap, audit);
1893 if (rc)
1894 return rc;
1895
1896 return cred_has_capability(cred, cap, audit);
1897 }
1898
1899 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1900 {
1901 const struct cred *cred = current_cred();
1902 int rc = 0;
1903
1904 if (!sb)
1905 return 0;
1906
1907 switch (cmds) {
1908 case Q_SYNC:
1909 case Q_QUOTAON:
1910 case Q_QUOTAOFF:
1911 case Q_SETINFO:
1912 case Q_SETQUOTA:
1913 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1914 break;
1915 case Q_GETFMT:
1916 case Q_GETINFO:
1917 case Q_GETQUOTA:
1918 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1919 break;
1920 default:
1921 rc = 0; /* let the kernel handle invalid cmds */
1922 break;
1923 }
1924 return rc;
1925 }
1926
1927 static int selinux_quota_on(struct dentry *dentry)
1928 {
1929 const struct cred *cred = current_cred();
1930
1931 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1932 }
1933
1934 static int selinux_syslog(int type)
1935 {
1936 int rc;
1937
1938 switch (type) {
1939 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1940 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1941 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1942 break;
1943 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1944 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1945 /* Set level of messages printed to console */
1946 case SYSLOG_ACTION_CONSOLE_LEVEL:
1947 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1948 break;
1949 case SYSLOG_ACTION_CLOSE: /* Close log */
1950 case SYSLOG_ACTION_OPEN: /* Open log */
1951 case SYSLOG_ACTION_READ: /* Read from log */
1952 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1953 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1954 default:
1955 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1956 break;
1957 }
1958 return rc;
1959 }
1960
1961 /*
1962 * Check that a process has enough memory to allocate a new virtual
1963 * mapping. 0 means there is enough memory for the allocation to
1964 * succeed and -ENOMEM implies there is not.
1965 *
1966 * Do not audit the selinux permission check, as this is applied to all
1967 * processes that allocate mappings.
1968 */
1969 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1970 {
1971 int rc, cap_sys_admin = 0;
1972
1973 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1974 SECURITY_CAP_NOAUDIT);
1975 if (rc == 0)
1976 cap_sys_admin = 1;
1977
1978 return __vm_enough_memory(mm, pages, cap_sys_admin);
1979 }
1980
1981 /* binprm security operations */
1982
1983 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1984 {
1985 const struct task_security_struct *old_tsec;
1986 struct task_security_struct *new_tsec;
1987 struct inode_security_struct *isec;
1988 struct common_audit_data ad;
1989 struct selinux_audit_data sad = {0,};
1990 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1991 int rc;
1992
1993 rc = cap_bprm_set_creds(bprm);
1994 if (rc)
1995 return rc;
1996
1997 /* SELinux context only depends on initial program or script and not
1998 * the script interpreter */
1999 if (bprm->cred_prepared)
2000 return 0;
2001
2002 old_tsec = current_security();
2003 new_tsec = bprm->cred->security;
2004 isec = inode->i_security;
2005
2006 /* Default to the current task SID. */
2007 new_tsec->sid = old_tsec->sid;
2008 new_tsec->osid = old_tsec->sid;
2009
2010 /* Reset fs, key, and sock SIDs on execve. */
2011 new_tsec->create_sid = 0;
2012 new_tsec->keycreate_sid = 0;
2013 new_tsec->sockcreate_sid = 0;
2014
2015 if (old_tsec->exec_sid) {
2016 new_tsec->sid = old_tsec->exec_sid;
2017 /* Reset exec SID on execve. */
2018 new_tsec->exec_sid = 0;
2019 } else {
2020 /* Check for a default transition on this program. */
2021 rc = security_transition_sid(old_tsec->sid, isec->sid,
2022 SECCLASS_PROCESS, NULL,
2023 &new_tsec->sid);
2024 if (rc)
2025 return rc;
2026 }
2027
2028 COMMON_AUDIT_DATA_INIT(&ad, PATH);
2029 ad.selinux_audit_data = &sad;
2030 ad.u.path = bprm->file->f_path;
2031
2032 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2033 new_tsec->sid = old_tsec->sid;
2034
2035 if (new_tsec->sid == old_tsec->sid) {
2036 rc = avc_has_perm(old_tsec->sid, isec->sid,
2037 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2038 if (rc)
2039 return rc;
2040 } else {
2041 /* Check permissions for the transition. */
2042 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2043 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2044 if (rc)
2045 return rc;
2046
2047 rc = avc_has_perm(new_tsec->sid, isec->sid,
2048 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2049 if (rc)
2050 return rc;
2051
2052 /* Check for shared state */
2053 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2054 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2055 SECCLASS_PROCESS, PROCESS__SHARE,
2056 NULL);
2057 if (rc)
2058 return -EPERM;
2059 }
2060
2061 /* Make sure that anyone attempting to ptrace over a task that
2062 * changes its SID has the appropriate permit */
2063 if (bprm->unsafe &
2064 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2065 struct task_struct *tracer;
2066 struct task_security_struct *sec;
2067 u32 ptsid = 0;
2068
2069 rcu_read_lock();
2070 tracer = ptrace_parent(current);
2071 if (likely(tracer != NULL)) {
2072 sec = __task_cred(tracer)->security;
2073 ptsid = sec->sid;
2074 }
2075 rcu_read_unlock();
2076
2077 if (ptsid != 0) {
2078 rc = avc_has_perm(ptsid, new_tsec->sid,
2079 SECCLASS_PROCESS,
2080 PROCESS__PTRACE, NULL);
2081 if (rc)
2082 return -EPERM;
2083 }
2084 }
2085
2086 /* Clear any possibly unsafe personality bits on exec: */
2087 bprm->per_clear |= PER_CLEAR_ON_SETID;
2088 }
2089
2090 return 0;
2091 }
2092
2093 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2094 {
2095 const struct task_security_struct *tsec = current_security();
2096 u32 sid, osid;
2097 int atsecure = 0;
2098
2099 sid = tsec->sid;
2100 osid = tsec->osid;
2101
2102 if (osid != sid) {
2103 /* Enable secure mode for SIDs transitions unless
2104 the noatsecure permission is granted between
2105 the two SIDs, i.e. ahp returns 0. */
2106 atsecure = avc_has_perm(osid, sid,
2107 SECCLASS_PROCESS,
2108 PROCESS__NOATSECURE, NULL);
2109 }
2110
2111 return (atsecure || cap_bprm_secureexec(bprm));
2112 }
2113
2114 /* Derived from fs/exec.c:flush_old_files. */
2115 static inline void flush_unauthorized_files(const struct cred *cred,
2116 struct files_struct *files)
2117 {
2118 struct common_audit_data ad;
2119 struct selinux_audit_data sad = {0,};
2120 struct file *file, *devnull = NULL;
2121 struct tty_struct *tty;
2122 struct fdtable *fdt;
2123 long j = -1;
2124 int drop_tty = 0;
2125
2126 tty = get_current_tty();
2127 if (tty) {
2128 spin_lock(&tty_files_lock);
2129 if (!list_empty(&tty->tty_files)) {
2130 struct tty_file_private *file_priv;
2131 struct inode *inode;
2132
2133 /* Revalidate access to controlling tty.
2134 Use inode_has_perm on the tty inode directly rather
2135 than using file_has_perm, as this particular open
2136 file may belong to another process and we are only
2137 interested in the inode-based check here. */
2138 file_priv = list_first_entry(&tty->tty_files,
2139 struct tty_file_private, list);
2140 file = file_priv->file;
2141 inode = file->f_path.dentry->d_inode;
2142 if (inode_has_perm_noadp(cred, inode,
2143 FILE__READ | FILE__WRITE, 0)) {
2144 drop_tty = 1;
2145 }
2146 }
2147 spin_unlock(&tty_files_lock);
2148 tty_kref_put(tty);
2149 }
2150 /* Reset controlling tty. */
2151 if (drop_tty)
2152 no_tty();
2153
2154 /* Revalidate access to inherited open files. */
2155
2156 COMMON_AUDIT_DATA_INIT(&ad, INODE);
2157 ad.selinux_audit_data = &sad;
2158
2159 spin_lock(&files->file_lock);
2160 for (;;) {
2161 unsigned long set, i;
2162 int fd;
2163
2164 j++;
2165 i = j * __NFDBITS;
2166 fdt = files_fdtable(files);
2167 if (i >= fdt->max_fds)
2168 break;
2169 set = fdt->open_fds[j];
2170 if (!set)
2171 continue;
2172 spin_unlock(&files->file_lock);
2173 for ( ; set ; i++, set >>= 1) {
2174 if (set & 1) {
2175 file = fget(i);
2176 if (!file)
2177 continue;
2178 if (file_has_perm(cred,
2179 file,
2180 file_to_av(file))) {
2181 sys_close(i);
2182 fd = get_unused_fd();
2183 if (fd != i) {
2184 if (fd >= 0)
2185 put_unused_fd(fd);
2186 fput(file);
2187 continue;
2188 }
2189 if (devnull) {
2190 get_file(devnull);
2191 } else {
2192 devnull = dentry_open(
2193 dget(selinux_null),
2194 mntget(selinuxfs_mount),
2195 O_RDWR, cred);
2196 if (IS_ERR(devnull)) {
2197 devnull = NULL;
2198 put_unused_fd(fd);
2199 fput(file);
2200 continue;
2201 }
2202 }
2203 fd_install(fd, devnull);
2204 }
2205 fput(file);
2206 }
2207 }
2208 spin_lock(&files->file_lock);
2209
2210 }
2211 spin_unlock(&files->file_lock);
2212 }
2213
2214 /*
2215 * Prepare a process for imminent new credential changes due to exec
2216 */
2217 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2218 {
2219 struct task_security_struct *new_tsec;
2220 struct rlimit *rlim, *initrlim;
2221 int rc, i;
2222
2223 new_tsec = bprm->cred->security;
2224 if (new_tsec->sid == new_tsec->osid)
2225 return;
2226
2227 /* Close files for which the new task SID is not authorized. */
2228 flush_unauthorized_files(bprm->cred, current->files);
2229
2230 /* Always clear parent death signal on SID transitions. */
2231 current->pdeath_signal = 0;
2232
2233 /* Check whether the new SID can inherit resource limits from the old
2234 * SID. If not, reset all soft limits to the lower of the current
2235 * task's hard limit and the init task's soft limit.
2236 *
2237 * Note that the setting of hard limits (even to lower them) can be
2238 * controlled by the setrlimit check. The inclusion of the init task's
2239 * soft limit into the computation is to avoid resetting soft limits
2240 * higher than the default soft limit for cases where the default is
2241 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2242 */
2243 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2244 PROCESS__RLIMITINH, NULL);
2245 if (rc) {
2246 /* protect against do_prlimit() */
2247 task_lock(current);
2248 for (i = 0; i < RLIM_NLIMITS; i++) {
2249 rlim = current->signal->rlim + i;
2250 initrlim = init_task.signal->rlim + i;
2251 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2252 }
2253 task_unlock(current);
2254 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2255 }
2256 }
2257
2258 /*
2259 * Clean up the process immediately after the installation of new credentials
2260 * due to exec
2261 */
2262 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2263 {
2264 const struct task_security_struct *tsec = current_security();
2265 struct itimerval itimer;
2266 u32 osid, sid;
2267 int rc, i;
2268
2269 osid = tsec->osid;
2270 sid = tsec->sid;
2271
2272 if (sid == osid)
2273 return;
2274
2275 /* Check whether the new SID can inherit signal state from the old SID.
2276 * If not, clear itimers to avoid subsequent signal generation and
2277 * flush and unblock signals.
2278 *
2279 * This must occur _after_ the task SID has been updated so that any
2280 * kill done after the flush will be checked against the new SID.
2281 */
2282 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2283 if (rc) {
2284 memset(&itimer, 0, sizeof itimer);
2285 for (i = 0; i < 3; i++)
2286 do_setitimer(i, &itimer, NULL);
2287 spin_lock_irq(&current->sighand->siglock);
2288 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2289 __flush_signals(current);
2290 flush_signal_handlers(current, 1);
2291 sigemptyset(&current->blocked);
2292 }
2293 spin_unlock_irq(&current->sighand->siglock);
2294 }
2295
2296 /* Wake up the parent if it is waiting so that it can recheck
2297 * wait permission to the new task SID. */
2298 read_lock(&tasklist_lock);
2299 __wake_up_parent(current, current->real_parent);
2300 read_unlock(&tasklist_lock);
2301 }
2302
2303 /* superblock security operations */
2304
2305 static int selinux_sb_alloc_security(struct super_block *sb)
2306 {
2307 return superblock_alloc_security(sb);
2308 }
2309
2310 static void selinux_sb_free_security(struct super_block *sb)
2311 {
2312 superblock_free_security(sb);
2313 }
2314
2315 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2316 {
2317 if (plen > olen)
2318 return 0;
2319
2320 return !memcmp(prefix, option, plen);
2321 }
2322
2323 static inline int selinux_option(char *option, int len)
2324 {
2325 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2326 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2327 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2328 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2329 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2330 }
2331
2332 static inline void take_option(char **to, char *from, int *first, int len)
2333 {
2334 if (!*first) {
2335 **to = ',';
2336 *to += 1;
2337 } else
2338 *first = 0;
2339 memcpy(*to, from, len);
2340 *to += len;
2341 }
2342
2343 static inline void take_selinux_option(char **to, char *from, int *first,
2344 int len)
2345 {
2346 int current_size = 0;
2347
2348 if (!*first) {
2349 **to = '|';
2350 *to += 1;
2351 } else
2352 *first = 0;
2353
2354 while (current_size < len) {
2355 if (*from != '"') {
2356 **to = *from;
2357 *to += 1;
2358 }
2359 from += 1;
2360 current_size += 1;
2361 }
2362 }
2363
2364 static int selinux_sb_copy_data(char *orig, char *copy)
2365 {
2366 int fnosec, fsec, rc = 0;
2367 char *in_save, *in_curr, *in_end;
2368 char *sec_curr, *nosec_save, *nosec;
2369 int open_quote = 0;
2370
2371 in_curr = orig;
2372 sec_curr = copy;
2373
2374 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2375 if (!nosec) {
2376 rc = -ENOMEM;
2377 goto out;
2378 }
2379
2380 nosec_save = nosec;
2381 fnosec = fsec = 1;
2382 in_save = in_end = orig;
2383
2384 do {
2385 if (*in_end == '"')
2386 open_quote = !open_quote;
2387 if ((*in_end == ',' && open_quote == 0) ||
2388 *in_end == '\0') {
2389 int len = in_end - in_curr;
2390
2391 if (selinux_option(in_curr, len))
2392 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2393 else
2394 take_option(&nosec, in_curr, &fnosec, len);
2395
2396 in_curr = in_end + 1;
2397 }
2398 } while (*in_end++);
2399
2400 strcpy(in_save, nosec_save);
2401 free_page((unsigned long)nosec_save);
2402 out:
2403 return rc;
2404 }
2405
2406 static int selinux_sb_remount(struct super_block *sb, void *data)
2407 {
2408 int rc, i, *flags;
2409 struct security_mnt_opts opts;
2410 char *secdata, **mount_options;
2411 struct superblock_security_struct *sbsec = sb->s_security;
2412
2413 if (!(sbsec->flags & SE_SBINITIALIZED))
2414 return 0;
2415
2416 if (!data)
2417 return 0;
2418
2419 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2420 return 0;
2421
2422 security_init_mnt_opts(&opts);
2423 secdata = alloc_secdata();
2424 if (!secdata)
2425 return -ENOMEM;
2426 rc = selinux_sb_copy_data(data, secdata);
2427 if (rc)
2428 goto out_free_secdata;
2429
2430 rc = selinux_parse_opts_str(secdata, &opts);
2431 if (rc)
2432 goto out_free_secdata;
2433
2434 mount_options = opts.mnt_opts;
2435 flags = opts.mnt_opts_flags;
2436
2437 for (i = 0; i < opts.num_mnt_opts; i++) {
2438 u32 sid;
2439 size_t len;
2440
2441 if (flags[i] == SE_SBLABELSUPP)
2442 continue;
2443 len = strlen(mount_options[i]);
2444 rc = security_context_to_sid(mount_options[i], len, &sid);
2445 if (rc) {
2446 printk(KERN_WARNING "SELinux: security_context_to_sid"
2447 "(%s) failed for (dev %s, type %s) errno=%d\n",
2448 mount_options[i], sb->s_id, sb->s_type->name, rc);
2449 goto out_free_opts;
2450 }
2451 rc = -EINVAL;
2452 switch (flags[i]) {
2453 case FSCONTEXT_MNT:
2454 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2455 goto out_bad_option;
2456 break;
2457 case CONTEXT_MNT:
2458 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2459 goto out_bad_option;
2460 break;
2461 case ROOTCONTEXT_MNT: {
2462 struct inode_security_struct *root_isec;
2463 root_isec = sb->s_root->d_inode->i_security;
2464
2465 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2466 goto out_bad_option;
2467 break;
2468 }
2469 case DEFCONTEXT_MNT:
2470 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2471 goto out_bad_option;
2472 break;
2473 default:
2474 goto out_free_opts;
2475 }
2476 }
2477
2478 rc = 0;
2479 out_free_opts:
2480 security_free_mnt_opts(&opts);
2481 out_free_secdata:
2482 free_secdata(secdata);
2483 return rc;
2484 out_bad_option:
2485 printk(KERN_WARNING "SELinux: unable to change security options "
2486 "during remount (dev %s, type=%s)\n", sb->s_id,
2487 sb->s_type->name);
2488 goto out_free_opts;
2489 }
2490
2491 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2492 {
2493 const struct cred *cred = current_cred();
2494 struct common_audit_data ad;
2495 struct selinux_audit_data sad = {0,};
2496 int rc;
2497
2498 rc = superblock_doinit(sb, data);
2499 if (rc)
2500 return rc;
2501
2502 /* Allow all mounts performed by the kernel */
2503 if (flags & MS_KERNMOUNT)
2504 return 0;
2505
2506 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2507 ad.selinux_audit_data = &sad;
2508 ad.u.dentry = sb->s_root;
2509 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2510 }
2511
2512 static int selinux_sb_statfs(struct dentry *dentry)
2513 {
2514 const struct cred *cred = current_cred();
2515 struct common_audit_data ad;
2516 struct selinux_audit_data sad = {0,};
2517
2518 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2519 ad.selinux_audit_data = &sad;
2520 ad.u.dentry = dentry->d_sb->s_root;
2521 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2522 }
2523
2524 static int selinux_mount(char *dev_name,
2525 struct path *path,
2526 char *type,
2527 unsigned long flags,
2528 void *data)
2529 {
2530 const struct cred *cred = current_cred();
2531
2532 if (flags & MS_REMOUNT)
2533 return superblock_has_perm(cred, path->dentry->d_sb,
2534 FILESYSTEM__REMOUNT, NULL);
2535 else
2536 return path_has_perm(cred, path, FILE__MOUNTON);
2537 }
2538
2539 static int selinux_umount(struct vfsmount *mnt, int flags)
2540 {
2541 const struct cred *cred = current_cred();
2542
2543 return superblock_has_perm(cred, mnt->mnt_sb,
2544 FILESYSTEM__UNMOUNT, NULL);
2545 }
2546
2547 /* inode security operations */
2548
2549 static int selinux_inode_alloc_security(struct inode *inode)
2550 {
2551 return inode_alloc_security(inode);
2552 }
2553
2554 static void selinux_inode_free_security(struct inode *inode)
2555 {
2556 inode_free_security(inode);
2557 }
2558
2559 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2560 const struct qstr *qstr, char **name,
2561 void **value, size_t *len)
2562 {
2563 const struct task_security_struct *tsec = current_security();
2564 struct inode_security_struct *dsec;
2565 struct superblock_security_struct *sbsec;
2566 u32 sid, newsid, clen;
2567 int rc;
2568 char *namep = NULL, *context;
2569
2570 dsec = dir->i_security;
2571 sbsec = dir->i_sb->s_security;
2572
2573 sid = tsec->sid;
2574 newsid = tsec->create_sid;
2575
2576 if ((sbsec->flags & SE_SBINITIALIZED) &&
2577 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2578 newsid = sbsec->mntpoint_sid;
2579 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2580 rc = security_transition_sid(sid, dsec->sid,
2581 inode_mode_to_security_class(inode->i_mode),
2582 qstr, &newsid);
2583 if (rc) {
2584 printk(KERN_WARNING "%s: "
2585 "security_transition_sid failed, rc=%d (dev=%s "
2586 "ino=%ld)\n",
2587 __func__,
2588 -rc, inode->i_sb->s_id, inode->i_ino);
2589 return rc;
2590 }
2591 }
2592
2593 /* Possibly defer initialization to selinux_complete_init. */
2594 if (sbsec->flags & SE_SBINITIALIZED) {
2595 struct inode_security_struct *isec = inode->i_security;
2596 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2597 isec->sid = newsid;
2598 isec->initialized = 1;
2599 }
2600
2601 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2602 return -EOPNOTSUPP;
2603
2604 if (name) {
2605 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2606 if (!namep)
2607 return -ENOMEM;
2608 *name = namep;
2609 }
2610
2611 if (value && len) {
2612 rc = security_sid_to_context_force(newsid, &context, &clen);
2613 if (rc) {
2614 kfree(namep);
2615 return rc;
2616 }
2617 *value = context;
2618 *len = clen;
2619 }
2620
2621 return 0;
2622 }
2623
2624 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2625 {
2626 return may_create(dir, dentry, SECCLASS_FILE);
2627 }
2628
2629 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2630 {
2631 return may_link(dir, old_dentry, MAY_LINK);
2632 }
2633
2634 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2635 {
2636 return may_link(dir, dentry, MAY_UNLINK);
2637 }
2638
2639 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2640 {
2641 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2642 }
2643
2644 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2645 {
2646 return may_create(dir, dentry, SECCLASS_DIR);
2647 }
2648
2649 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2650 {
2651 return may_link(dir, dentry, MAY_RMDIR);
2652 }
2653
2654 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2655 {
2656 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2657 }
2658
2659 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2660 struct inode *new_inode, struct dentry *new_dentry)
2661 {
2662 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2663 }
2664
2665 static int selinux_inode_readlink(struct dentry *dentry)
2666 {
2667 const struct cred *cred = current_cred();
2668
2669 return dentry_has_perm(cred, dentry, FILE__READ);
2670 }
2671
2672 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2673 {
2674 const struct cred *cred = current_cred();
2675
2676 return dentry_has_perm(cred, dentry, FILE__READ);
2677 }
2678
2679 static int selinux_inode_permission(struct inode *inode, int mask)
2680 {
2681 const struct cred *cred = current_cred();
2682 struct common_audit_data ad;
2683 struct selinux_audit_data sad = {0,};
2684 u32 perms;
2685 bool from_access;
2686 unsigned flags = mask & MAY_NOT_BLOCK;
2687
2688 from_access = mask & MAY_ACCESS;
2689 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2690
2691 /* No permission to check. Existence test. */
2692 if (!mask)
2693 return 0;
2694
2695 COMMON_AUDIT_DATA_INIT(&ad, INODE);
2696 ad.selinux_audit_data = &sad;
2697 ad.u.inode = inode;
2698
2699 if (from_access)
2700 ad.selinux_audit_data->auditdeny |= FILE__AUDIT_ACCESS;
2701
2702 perms = file_mask_to_av(inode->i_mode, mask);
2703
2704 return inode_has_perm(cred, inode, perms, &ad, flags);
2705 }
2706
2707 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2708 {
2709 const struct cred *cred = current_cred();
2710 unsigned int ia_valid = iattr->ia_valid;
2711 __u32 av = FILE__WRITE;
2712
2713 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2714 if (ia_valid & ATTR_FORCE) {
2715 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2716 ATTR_FORCE);
2717 if (!ia_valid)
2718 return 0;
2719 }
2720
2721 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2722 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2723 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2724
2725 if (ia_valid & ATTR_SIZE)
2726 av |= FILE__OPEN;
2727
2728 return dentry_has_perm(cred, dentry, av);
2729 }
2730
2731 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2732 {
2733 const struct cred *cred = current_cred();
2734 struct path path;
2735
2736 path.dentry = dentry;
2737 path.mnt = mnt;
2738
2739 return path_has_perm(cred, &path, FILE__GETATTR);
2740 }
2741
2742 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2743 {
2744 const struct cred *cred = current_cred();
2745
2746 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2747 sizeof XATTR_SECURITY_PREFIX - 1)) {
2748 if (!strcmp(name, XATTR_NAME_CAPS)) {
2749 if (!capable(CAP_SETFCAP))
2750 return -EPERM;
2751 } else if (!capable(CAP_SYS_ADMIN)) {
2752 /* A different attribute in the security namespace.
2753 Restrict to administrator. */
2754 return -EPERM;
2755 }
2756 }
2757
2758 /* Not an attribute we recognize, so just check the
2759 ordinary setattr permission. */
2760 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2761 }
2762
2763 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2764 const void *value, size_t size, int flags)
2765 {
2766 struct inode *inode = dentry->d_inode;
2767 struct inode_security_struct *isec = inode->i_security;
2768 struct superblock_security_struct *sbsec;
2769 struct common_audit_data ad;
2770 struct selinux_audit_data sad = {0,};
2771 u32 newsid, sid = current_sid();
2772 int rc = 0;
2773
2774 if (strcmp(name, XATTR_NAME_SELINUX))
2775 return selinux_inode_setotherxattr(dentry, name);
2776
2777 sbsec = inode->i_sb->s_security;
2778 if (!(sbsec->flags & SE_SBLABELSUPP))
2779 return -EOPNOTSUPP;
2780
2781 if (!inode_owner_or_capable(inode))
2782 return -EPERM;
2783
2784 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2785 ad.selinux_audit_data = &sad;
2786 ad.u.dentry = dentry;
2787
2788 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2789 FILE__RELABELFROM, &ad);
2790 if (rc)
2791 return rc;
2792
2793 rc = security_context_to_sid(value, size, &newsid);
2794 if (rc == -EINVAL) {
2795 if (!capable(CAP_MAC_ADMIN)) {
2796 struct audit_buffer *ab;
2797 size_t audit_size;
2798 const char *str;
2799
2800 /* We strip a nul only if it is at the end, otherwise the
2801 * context contains a nul and we should audit that */
2802 str = value;
2803 if (str[size - 1] == '\0')
2804 audit_size = size - 1;
2805 else
2806 audit_size = size;
2807 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2808 audit_log_format(ab, "op=setxattr invalid_context=");
2809 audit_log_n_untrustedstring(ab, value, audit_size);
2810 audit_log_end(ab);
2811
2812 return rc;
2813 }
2814 rc = security_context_to_sid_force(value, size, &newsid);
2815 }
2816 if (rc)
2817 return rc;
2818
2819 rc = avc_has_perm(sid, newsid, isec->sclass,
2820 FILE__RELABELTO, &ad);
2821 if (rc)
2822 return rc;
2823
2824 rc = security_validate_transition(isec->sid, newsid, sid,
2825 isec->sclass);
2826 if (rc)
2827 return rc;
2828
2829 return avc_has_perm(newsid,
2830 sbsec->sid,
2831 SECCLASS_FILESYSTEM,
2832 FILESYSTEM__ASSOCIATE,
2833 &ad);
2834 }
2835
2836 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2837 const void *value, size_t size,
2838 int flags)
2839 {
2840 struct inode *inode = dentry->d_inode;
2841 struct inode_security_struct *isec = inode->i_security;
2842 u32 newsid;
2843 int rc;
2844
2845 if (strcmp(name, XATTR_NAME_SELINUX)) {
2846 /* Not an attribute we recognize, so nothing to do. */
2847 return;
2848 }
2849
2850 rc = security_context_to_sid_force(value, size, &newsid);
2851 if (rc) {
2852 printk(KERN_ERR "SELinux: unable to map context to SID"
2853 "for (%s, %lu), rc=%d\n",
2854 inode->i_sb->s_id, inode->i_ino, -rc);
2855 return;
2856 }
2857
2858 isec->sid = newsid;
2859 return;
2860 }
2861
2862 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2863 {
2864 const struct cred *cred = current_cred();
2865
2866 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2867 }
2868
2869 static int selinux_inode_listxattr(struct dentry *dentry)
2870 {
2871 const struct cred *cred = current_cred();
2872
2873 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2874 }
2875
2876 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2877 {
2878 if (strcmp(name, XATTR_NAME_SELINUX))
2879 return selinux_inode_setotherxattr(dentry, name);
2880
2881 /* No one is allowed to remove a SELinux security label.
2882 You can change the label, but all data must be labeled. */
2883 return -EACCES;
2884 }
2885
2886 /*
2887 * Copy the inode security context value to the user.
2888 *
2889 * Permission check is handled by selinux_inode_getxattr hook.
2890 */
2891 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2892 {
2893 u32 size;
2894 int error;
2895 char *context = NULL;
2896 struct inode_security_struct *isec = inode->i_security;
2897
2898 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2899 return -EOPNOTSUPP;
2900
2901 /*
2902 * If the caller has CAP_MAC_ADMIN, then get the raw context
2903 * value even if it is not defined by current policy; otherwise,
2904 * use the in-core value under current policy.
2905 * Use the non-auditing forms of the permission checks since
2906 * getxattr may be called by unprivileged processes commonly
2907 * and lack of permission just means that we fall back to the
2908 * in-core context value, not a denial.
2909 */
2910 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2911 SECURITY_CAP_NOAUDIT);
2912 if (!error)
2913 error = security_sid_to_context_force(isec->sid, &context,
2914 &size);
2915 else
2916 error = security_sid_to_context(isec->sid, &context, &size);
2917 if (error)
2918 return error;
2919 error = size;
2920 if (alloc) {
2921 *buffer = context;
2922 goto out_nofree;
2923 }
2924 kfree(context);
2925 out_nofree:
2926 return error;
2927 }
2928
2929 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2930 const void *value, size_t size, int flags)
2931 {
2932 struct inode_security_struct *isec = inode->i_security;
2933 u32 newsid;
2934 int rc;
2935
2936 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2937 return -EOPNOTSUPP;
2938
2939 if (!value || !size)
2940 return -EACCES;
2941
2942 rc = security_context_to_sid((void *)value, size, &newsid);
2943 if (rc)
2944 return rc;
2945
2946 isec->sid = newsid;
2947 isec->initialized = 1;
2948 return 0;
2949 }
2950
2951 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2952 {
2953 const int len = sizeof(XATTR_NAME_SELINUX);
2954 if (buffer && len <= buffer_size)
2955 memcpy(buffer, XATTR_NAME_SELINUX, len);
2956 return len;
2957 }
2958
2959 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2960 {
2961 struct inode_security_struct *isec = inode->i_security;
2962 *secid = isec->sid;
2963 }
2964
2965 /* file security operations */
2966
2967 static int selinux_revalidate_file_permission(struct file *file, int mask)
2968 {
2969 const struct cred *cred = current_cred();
2970 struct inode *inode = file->f_path.dentry->d_inode;
2971
2972 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2973 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2974 mask |= MAY_APPEND;
2975
2976 return file_has_perm(cred, file,
2977 file_mask_to_av(inode->i_mode, mask));
2978 }
2979
2980 static int selinux_file_permission(struct file *file, int mask)
2981 {
2982 struct inode *inode = file->f_path.dentry->d_inode;
2983 struct file_security_struct *fsec = file->f_security;
2984 struct inode_security_struct *isec = inode->i_security;
2985 u32 sid = current_sid();
2986
2987 if (!mask)
2988 /* No permission to check. Existence test. */
2989 return 0;
2990
2991 if (sid == fsec->sid && fsec->isid == isec->sid &&
2992 fsec->pseqno == avc_policy_seqno())
2993 /* No change since file_open check. */
2994 return 0;
2995
2996 return selinux_revalidate_file_permission(file, mask);
2997 }
2998
2999 static int selinux_file_alloc_security(struct file *file)
3000 {
3001 return file_alloc_security(file);
3002 }
3003
3004 static void selinux_file_free_security(struct file *file)
3005 {
3006 file_free_security(file);
3007 }
3008
3009 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3010 unsigned long arg)
3011 {
3012 const struct cred *cred = current_cred();
3013 int error = 0;
3014
3015 switch (cmd) {
3016 case FIONREAD:
3017 /* fall through */
3018 case FIBMAP:
3019 /* fall through */
3020 case FIGETBSZ:
3021 /* fall through */
3022 case FS_IOC_GETFLAGS:
3023 /* fall through */
3024 case FS_IOC_GETVERSION:
3025 error = file_has_perm(cred, file, FILE__GETATTR);
3026 break;
3027
3028 case FS_IOC_SETFLAGS:
3029 /* fall through */
3030 case FS_IOC_SETVERSION:
3031 error = file_has_perm(cred, file, FILE__SETATTR);
3032 break;
3033
3034 /* sys_ioctl() checks */
3035 case FIONBIO:
3036 /* fall through */
3037 case FIOASYNC:
3038 error = file_has_perm(cred, file, 0);
3039 break;
3040
3041 case KDSKBENT:
3042 case KDSKBSENT:
3043 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3044 SECURITY_CAP_AUDIT);
3045 break;
3046
3047 /* default case assumes that the command will go
3048 * to the file's ioctl() function.
3049 */
3050 default:
3051 error = file_has_perm(cred, file, FILE__IOCTL);
3052 }
3053 return error;
3054 }
3055
3056 static int default_noexec;
3057
3058 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3059 {
3060 const struct cred *cred = current_cred();
3061 int rc = 0;
3062
3063 if (default_noexec &&
3064 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3065 /*
3066 * We are making executable an anonymous mapping or a
3067 * private file mapping that will also be writable.
3068 * This has an additional check.
3069 */
3070 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3071 if (rc)
3072 goto error;
3073 }
3074
3075 if (file) {
3076 /* read access is always possible with a mapping */
3077 u32 av = FILE__READ;
3078
3079 /* write access only matters if the mapping is shared */
3080 if (shared && (prot & PROT_WRITE))
3081 av |= FILE__WRITE;
3082
3083 if (prot & PROT_EXEC)
3084 av |= FILE__EXECUTE;
3085
3086 return file_has_perm(cred, file, av);
3087 }
3088
3089 error:
3090 return rc;
3091 }
3092
3093 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3094 unsigned long prot, unsigned long flags,
3095 unsigned long addr, unsigned long addr_only)
3096 {
3097 int rc = 0;
3098 u32 sid = current_sid();
3099
3100 /*
3101 * notice that we are intentionally putting the SELinux check before
3102 * the secondary cap_file_mmap check. This is such a likely attempt
3103 * at bad behaviour/exploit that we always want to get the AVC, even
3104 * if DAC would have also denied the operation.
3105 */
3106 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3107 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3108 MEMPROTECT__MMAP_ZERO, NULL);
3109 if (rc)
3110 return rc;
3111 }
3112
3113 /* do DAC check on address space usage */
3114 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3115 if (rc || addr_only)
3116 return rc;
3117
3118 if (selinux_checkreqprot)
3119 prot = reqprot;
3120
3121 return file_map_prot_check(file, prot,
3122 (flags & MAP_TYPE) == MAP_SHARED);
3123 }
3124
3125 static int selinux_file_mprotect(struct vm_area_struct *vma,
3126 unsigned long reqprot,
3127 unsigned long prot)
3128 {
3129 const struct cred *cred = current_cred();
3130
3131 if (selinux_checkreqprot)
3132 prot = reqprot;
3133
3134 if (default_noexec &&
3135 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3136 int rc = 0;
3137 if (vma->vm_start >= vma->vm_mm->start_brk &&
3138 vma->vm_end <= vma->vm_mm->brk) {
3139 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3140 } else if (!vma->vm_file &&
3141 vma->vm_start <= vma->vm_mm->start_stack &&
3142 vma->vm_end >= vma->vm_mm->start_stack) {
3143 rc = current_has_perm(current, PROCESS__EXECSTACK);
3144 } else if (vma->vm_file && vma->anon_vma) {
3145 /*
3146 * We are making executable a file mapping that has
3147 * had some COW done. Since pages might have been
3148 * written, check ability to execute the possibly
3149 * modified content. This typically should only
3150 * occur for text relocations.
3151 */
3152 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3153 }
3154 if (rc)
3155 return rc;
3156 }
3157
3158 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3159 }
3160
3161 static int selinux_file_lock(struct file *file, unsigned int cmd)
3162 {
3163 const struct cred *cred = current_cred();
3164
3165 return file_has_perm(cred, file, FILE__LOCK);
3166 }
3167
3168 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3169 unsigned long arg)
3170 {
3171 const struct cred *cred = current_cred();
3172 int err = 0;
3173
3174 switch (cmd) {
3175 case F_SETFL:
3176 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3177 err = -EINVAL;
3178 break;
3179 }
3180
3181 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3182 err = file_has_perm(cred, file, FILE__WRITE);
3183 break;
3184 }
3185 /* fall through */
3186 case F_SETOWN:
3187 case F_SETSIG:
3188 case F_GETFL:
3189 case F_GETOWN:
3190 case F_GETSIG:
3191 /* Just check FD__USE permission */
3192 err = file_has_perm(cred, file, 0);
3193 break;
3194 case F_GETLK:
3195 case F_SETLK:
3196 case F_SETLKW:
3197 #if BITS_PER_LONG == 32
3198 case F_GETLK64:
3199 case F_SETLK64:
3200 case F_SETLKW64:
3201 #endif
3202 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3203 err = -EINVAL;
3204 break;
3205 }
3206 err = file_has_perm(cred, file, FILE__LOCK);
3207 break;
3208 }
3209
3210 return err;
3211 }
3212
3213 static int selinux_file_set_fowner(struct file *file)
3214 {
3215 struct file_security_struct *fsec;
3216
3217 fsec = file->f_security;
3218 fsec->fown_sid = current_sid();
3219
3220 return 0;
3221 }
3222
3223 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3224 struct fown_struct *fown, int signum)
3225 {
3226 struct file *file;
3227 u32 sid = task_sid(tsk);
3228 u32 perm;
3229 struct file_security_struct *fsec;
3230
3231 /* struct fown_struct is never outside the context of a struct file */
3232 file = container_of(fown, struct file, f_owner);
3233
3234 fsec = file->f_security;
3235
3236 if (!signum)
3237 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3238 else
3239 perm = signal_to_av(signum);
3240
3241 return avc_has_perm(fsec->fown_sid, sid,
3242 SECCLASS_PROCESS, perm, NULL);
3243 }
3244
3245 static int selinux_file_receive(struct file *file)
3246 {
3247 const struct cred *cred = current_cred();
3248
3249 return file_has_perm(cred, file, file_to_av(file));
3250 }
3251
3252 static int selinux_file_open(struct file *file, const struct cred *cred)
3253 {
3254 struct file_security_struct *fsec;
3255 struct inode *inode;
3256 struct inode_security_struct *isec;
3257
3258 inode = file->f_path.dentry->d_inode;
3259 fsec = file->f_security;
3260 isec = inode->i_security;
3261 /*
3262 * Save inode label and policy sequence number
3263 * at open-time so that selinux_file_permission
3264 * can determine whether revalidation is necessary.
3265 * Task label is already saved in the file security
3266 * struct as its SID.
3267 */
3268 fsec->isid = isec->sid;
3269 fsec->pseqno = avc_policy_seqno();
3270 /*
3271 * Since the inode label or policy seqno may have changed
3272 * between the selinux_inode_permission check and the saving
3273 * of state above, recheck that access is still permitted.
3274 * Otherwise, access might never be revalidated against the
3275 * new inode label or new policy.
3276 * This check is not redundant - do not remove.
3277 */
3278 return inode_has_perm_noadp(cred, inode, open_file_to_av(file), 0);
3279 }
3280
3281 /* task security operations */
3282
3283 static int selinux_task_create(unsigned long clone_flags)
3284 {
3285 return current_has_perm(current, PROCESS__FORK);
3286 }
3287
3288 /*
3289 * allocate the SELinux part of blank credentials
3290 */
3291 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3292 {
3293 struct task_security_struct *tsec;
3294
3295 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3296 if (!tsec)
3297 return -ENOMEM;
3298
3299 cred->security = tsec;
3300 return 0;
3301 }
3302
3303 /*
3304 * detach and free the LSM part of a set of credentials
3305 */
3306 static void selinux_cred_free(struct cred *cred)
3307 {
3308 struct task_security_struct *tsec = cred->security;
3309
3310 /*
3311 * cred->security == NULL if security_cred_alloc_blank() or
3312 * security_prepare_creds() returned an error.
3313 */
3314 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3315 cred->security = (void *) 0x7UL;
3316 kfree(tsec);
3317 }
3318
3319 /*
3320 * prepare a new set of credentials for modification
3321 */
3322 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3323 gfp_t gfp)
3324 {
3325 const struct task_security_struct *old_tsec;
3326 struct task_security_struct *tsec;
3327
3328 old_tsec = old->security;
3329
3330 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3331 if (!tsec)
3332 return -ENOMEM;
3333
3334 new->security = tsec;
3335 return 0;
3336 }
3337
3338 /*
3339 * transfer the SELinux data to a blank set of creds
3340 */
3341 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3342 {
3343 const struct task_security_struct *old_tsec = old->security;
3344 struct task_security_struct *tsec = new->security;
3345
3346 *tsec = *old_tsec;
3347 }
3348
3349 /*
3350 * set the security data for a kernel service
3351 * - all the creation contexts are set to unlabelled
3352 */
3353 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3354 {
3355 struct task_security_struct *tsec = new->security;
3356 u32 sid = current_sid();
3357 int ret;
3358
3359 ret = avc_has_perm(sid, secid,
3360 SECCLASS_KERNEL_SERVICE,
3361 KERNEL_SERVICE__USE_AS_OVERRIDE,
3362 NULL);
3363 if (ret == 0) {
3364 tsec->sid = secid;
3365 tsec->create_sid = 0;
3366 tsec->keycreate_sid = 0;
3367 tsec->sockcreate_sid = 0;
3368 }
3369 return ret;
3370 }
3371
3372 /*
3373 * set the file creation context in a security record to the same as the
3374 * objective context of the specified inode
3375 */
3376 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3377 {
3378 struct inode_security_struct *isec = inode->i_security;
3379 struct task_security_struct *tsec = new->security;
3380 u32 sid = current_sid();
3381 int ret;
3382
3383 ret = avc_has_perm(sid, isec->sid,
3384 SECCLASS_KERNEL_SERVICE,
3385 KERNEL_SERVICE__CREATE_FILES_AS,
3386 NULL);
3387
3388 if (ret == 0)
3389 tsec->create_sid = isec->sid;
3390 return ret;
3391 }
3392
3393 static int selinux_kernel_module_request(char *kmod_name)
3394 {
3395 u32 sid;
3396 struct common_audit_data ad;
3397 struct selinux_audit_data sad = {0,};
3398
3399 sid = task_sid(current);
3400
3401 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3402 ad.selinux_audit_data = &sad;
3403 ad.u.kmod_name = kmod_name;
3404
3405 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3406 SYSTEM__MODULE_REQUEST, &ad);
3407 }
3408
3409 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3410 {
3411 return current_has_perm(p, PROCESS__SETPGID);
3412 }
3413
3414 static int selinux_task_getpgid(struct task_struct *p)
3415 {
3416 return current_has_perm(p, PROCESS__GETPGID);
3417 }
3418
3419 static int selinux_task_getsid(struct task_struct *p)
3420 {
3421 return current_has_perm(p, PROCESS__GETSESSION);
3422 }
3423
3424 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3425 {
3426 *secid = task_sid(p);
3427 }
3428
3429 static int selinux_task_setnice(struct task_struct *p, int nice)
3430 {
3431 int rc;
3432
3433 rc = cap_task_setnice(p, nice);
3434 if (rc)
3435 return rc;
3436
3437 return current_has_perm(p, PROCESS__SETSCHED);
3438 }
3439
3440 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3441 {
3442 int rc;
3443
3444 rc = cap_task_setioprio(p, ioprio);
3445 if (rc)
3446 return rc;
3447
3448 return current_has_perm(p, PROCESS__SETSCHED);
3449 }
3450
3451 static int selinux_task_getioprio(struct task_struct *p)
3452 {
3453 return current_has_perm(p, PROCESS__GETSCHED);
3454 }
3455
3456 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3457 struct rlimit *new_rlim)
3458 {
3459 struct rlimit *old_rlim = p->signal->rlim + resource;
3460
3461 /* Control the ability to change the hard limit (whether
3462 lowering or raising it), so that the hard limit can
3463 later be used as a safe reset point for the soft limit
3464 upon context transitions. See selinux_bprm_committing_creds. */
3465 if (old_rlim->rlim_max != new_rlim->rlim_max)
3466 return current_has_perm(p, PROCESS__SETRLIMIT);
3467
3468 return 0;
3469 }
3470
3471 static int selinux_task_setscheduler(struct task_struct *p)
3472 {
3473 int rc;
3474
3475 rc = cap_task_setscheduler(p);
3476 if (rc)
3477 return rc;
3478
3479 return current_has_perm(p, PROCESS__SETSCHED);
3480 }
3481
3482 static int selinux_task_getscheduler(struct task_struct *p)
3483 {
3484 return current_has_perm(p, PROCESS__GETSCHED);
3485 }
3486
3487 static int selinux_task_movememory(struct task_struct *p)
3488 {
3489 return current_has_perm(p, PROCESS__SETSCHED);
3490 }
3491
3492 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3493 int sig, u32 secid)
3494 {
3495 u32 perm;
3496 int rc;
3497
3498 if (!sig)
3499 perm = PROCESS__SIGNULL; /* null signal; existence test */
3500 else
3501 perm = signal_to_av(sig);
3502 if (secid)
3503 rc = avc_has_perm(secid, task_sid(p),
3504 SECCLASS_PROCESS, perm, NULL);
3505 else
3506 rc = current_has_perm(p, perm);
3507 return rc;
3508 }
3509
3510 static int selinux_task_wait(struct task_struct *p)
3511 {
3512 return task_has_perm(p, current, PROCESS__SIGCHLD);
3513 }
3514
3515 static void selinux_task_to_inode(struct task_struct *p,
3516 struct inode *inode)
3517 {
3518 struct inode_security_struct *isec = inode->i_security;
3519 u32 sid = task_sid(p);
3520
3521 isec->sid = sid;
3522 isec->initialized = 1;
3523 }
3524
3525 /* Returns error only if unable to parse addresses */
3526 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3527 struct common_audit_data *ad, u8 *proto)
3528 {
3529 int offset, ihlen, ret = -EINVAL;
3530 struct iphdr _iph, *ih;
3531
3532 offset = skb_network_offset(skb);
3533 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3534 if (ih == NULL)
3535 goto out;
3536
3537 ihlen = ih->ihl * 4;
3538 if (ihlen < sizeof(_iph))
3539 goto out;
3540
3541 ad->u.net->v4info.saddr = ih->saddr;
3542 ad->u.net->v4info.daddr = ih->daddr;
3543 ret = 0;
3544
3545 if (proto)
3546 *proto = ih->protocol;
3547
3548 switch (ih->protocol) {
3549 case IPPROTO_TCP: {
3550 struct tcphdr _tcph, *th;
3551
3552 if (ntohs(ih->frag_off) & IP_OFFSET)
3553 break;
3554
3555 offset += ihlen;
3556 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3557 if (th == NULL)
3558 break;
3559
3560 ad->u.net->sport = th->source;
3561 ad->u.net->dport = th->dest;
3562 break;
3563 }
3564
3565 case IPPROTO_UDP: {
3566 struct udphdr _udph, *uh;
3567
3568 if (ntohs(ih->frag_off) & IP_OFFSET)
3569 break;
3570
3571 offset += ihlen;
3572 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3573 if (uh == NULL)
3574 break;
3575
3576 ad->u.net->sport = uh->source;
3577 ad->u.net->dport = uh->dest;
3578 break;
3579 }
3580
3581 case IPPROTO_DCCP: {
3582 struct dccp_hdr _dccph, *dh;
3583
3584 if (ntohs(ih->frag_off) & IP_OFFSET)
3585 break;
3586
3587 offset += ihlen;
3588 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3589 if (dh == NULL)
3590 break;
3591
3592 ad->u.net->sport = dh->dccph_sport;
3593 ad->u.net->dport = dh->dccph_dport;
3594 break;
3595 }
3596
3597 default:
3598 break;
3599 }
3600 out:
3601 return ret;
3602 }
3603
3604 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3605
3606 /* Returns error only if unable to parse addresses */
3607 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3608 struct common_audit_data *ad, u8 *proto)
3609 {
3610 u8 nexthdr;
3611 int ret = -EINVAL, offset;
3612 struct ipv6hdr _ipv6h, *ip6;
3613 __be16 frag_off;
3614
3615 offset = skb_network_offset(skb);
3616 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3617 if (ip6 == NULL)
3618 goto out;
3619
3620 ad->u.net->v6info.saddr = ip6->saddr;
3621 ad->u.net->v6info.daddr = ip6->daddr;
3622 ret = 0;
3623
3624 nexthdr = ip6->nexthdr;
3625 offset += sizeof(_ipv6h);
3626 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3627 if (offset < 0)
3628 goto out;
3629
3630 if (proto)
3631 *proto = nexthdr;
3632
3633 switch (nexthdr) {
3634 case IPPROTO_TCP: {
3635 struct tcphdr _tcph, *th;
3636
3637 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3638 if (th == NULL)
3639 break;
3640
3641 ad->u.net->sport = th->source;
3642 ad->u.net->dport = th->dest;
3643 break;
3644 }
3645
3646 case IPPROTO_UDP: {
3647 struct udphdr _udph, *uh;
3648
3649 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3650 if (uh == NULL)
3651 break;
3652
3653 ad->u.net->sport = uh->source;
3654 ad->u.net->dport = uh->dest;
3655 break;
3656 }
3657
3658 case IPPROTO_DCCP: {
3659 struct dccp_hdr _dccph, *dh;
3660
3661 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3662 if (dh == NULL)
3663 break;
3664
3665 ad->u.net->sport = dh->dccph_sport;
3666 ad->u.net->dport = dh->dccph_dport;
3667 break;
3668 }
3669
3670 /* includes fragments */
3671 default:
3672 break;
3673 }
3674 out:
3675 return ret;
3676 }
3677
3678 #endif /* IPV6 */
3679
3680 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3681 char **_addrp, int src, u8 *proto)
3682 {
3683 char *addrp;
3684 int ret;
3685
3686 switch (ad->u.net->family) {
3687 case PF_INET:
3688 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3689 if (ret)
3690 goto parse_error;
3691 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3692 &ad->u.net->v4info.daddr);
3693 goto okay;
3694
3695 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3696 case PF_INET6:
3697 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3698 if (ret)
3699 goto parse_error;
3700 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3701 &ad->u.net->v6info.daddr);
3702 goto okay;
3703 #endif /* IPV6 */
3704 default:
3705 addrp = NULL;
3706 goto okay;
3707 }
3708
3709 parse_error:
3710 printk(KERN_WARNING
3711 "SELinux: failure in selinux_parse_skb(),"
3712 " unable to parse packet\n");
3713 return ret;
3714
3715 okay:
3716 if (_addrp)
3717 *_addrp = addrp;
3718 return 0;
3719 }
3720
3721 /**
3722 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3723 * @skb: the packet
3724 * @family: protocol family
3725 * @sid: the packet's peer label SID
3726 *
3727 * Description:
3728 * Check the various different forms of network peer labeling and determine
3729 * the peer label/SID for the packet; most of the magic actually occurs in
3730 * the security server function security_net_peersid_cmp(). The function
3731 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3732 * or -EACCES if @sid is invalid due to inconsistencies with the different
3733 * peer labels.
3734 *
3735 */
3736 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3737 {
3738 int err;
3739 u32 xfrm_sid;
3740 u32 nlbl_sid;
3741 u32 nlbl_type;
3742
3743 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3744 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3745
3746 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3747 if (unlikely(err)) {
3748 printk(KERN_WARNING
3749 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3750 " unable to determine packet's peer label\n");
3751 return -EACCES;
3752 }
3753
3754 return 0;
3755 }
3756
3757 /* socket security operations */
3758
3759 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3760 u16 secclass, u32 *socksid)
3761 {
3762 if (tsec->sockcreate_sid > SECSID_NULL) {
3763 *socksid = tsec->sockcreate_sid;
3764 return 0;
3765 }
3766
3767 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3768 socksid);
3769 }
3770
3771 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3772 {
3773 struct sk_security_struct *sksec = sk->sk_security;
3774 struct common_audit_data ad;
3775 struct selinux_audit_data sad = {0,};
3776 struct lsm_network_audit net = {0,};
3777 u32 tsid = task_sid(task);
3778
3779 if (sksec->sid == SECINITSID_KERNEL)
3780 return 0;
3781
3782 COMMON_AUDIT_DATA_INIT(&ad, NET);
3783 ad.selinux_audit_data = &sad;
3784 ad.u.net = &net;
3785 ad.u.net->sk = sk;
3786
3787 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3788 }
3789
3790 static int selinux_socket_create(int family, int type,
3791 int protocol, int kern)
3792 {
3793 const struct task_security_struct *tsec = current_security();
3794 u32 newsid;
3795 u16 secclass;
3796 int rc;
3797
3798 if (kern)
3799 return 0;
3800
3801 secclass = socket_type_to_security_class(family, type, protocol);
3802 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3803 if (rc)
3804 return rc;
3805
3806 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3807 }
3808
3809 static int selinux_socket_post_create(struct socket *sock, int family,
3810 int type, int protocol, int kern)
3811 {
3812 const struct task_security_struct *tsec = current_security();
3813 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3814 struct sk_security_struct *sksec;
3815 int err = 0;
3816
3817 isec->sclass = socket_type_to_security_class(family, type, protocol);
3818
3819 if (kern)
3820 isec->sid = SECINITSID_KERNEL;
3821 else {
3822 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3823 if (err)
3824 return err;
3825 }
3826
3827 isec->initialized = 1;
3828
3829 if (sock->sk) {
3830 sksec = sock->sk->sk_security;
3831 sksec->sid = isec->sid;
3832 sksec->sclass = isec->sclass;
3833 err = selinux_netlbl_socket_post_create(sock->sk, family);
3834 }
3835
3836 return err;
3837 }
3838
3839 /* Range of port numbers used to automatically bind.
3840 Need to determine whether we should perform a name_bind
3841 permission check between the socket and the port number. */
3842
3843 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3844 {
3845 struct sock *sk = sock->sk;
3846 u16 family;
3847 int err;
3848
3849 err = sock_has_perm(current, sk, SOCKET__BIND);
3850 if (err)
3851 goto out;
3852
3853 /*
3854 * If PF_INET or PF_INET6, check name_bind permission for the port.
3855 * Multiple address binding for SCTP is not supported yet: we just
3856 * check the first address now.
3857 */
3858 family = sk->sk_family;
3859 if (family == PF_INET || family == PF_INET6) {
3860 char *addrp;
3861 struct sk_security_struct *sksec = sk->sk_security;
3862 struct common_audit_data ad;
3863 struct selinux_audit_data sad = {0,};
3864 struct lsm_network_audit net = {0,};
3865 struct sockaddr_in *addr4 = NULL;
3866 struct sockaddr_in6 *addr6 = NULL;
3867 unsigned short snum;
3868 u32 sid, node_perm;
3869
3870 if (family == PF_INET) {
3871 addr4 = (struct sockaddr_in *)address;
3872 snum = ntohs(addr4->sin_port);
3873 addrp = (char *)&addr4->sin_addr.s_addr;
3874 } else {
3875 addr6 = (struct sockaddr_in6 *)address;
3876 snum = ntohs(addr6->sin6_port);
3877 addrp = (char *)&addr6->sin6_addr.s6_addr;
3878 }
3879
3880 if (snum) {
3881 int low, high;
3882
3883 inet_get_local_port_range(&low, &high);
3884
3885 if (snum < max(PROT_SOCK, low) || snum > high) {
3886 err = sel_netport_sid(sk->sk_protocol,
3887 snum, &sid);
3888 if (err)
3889 goto out;
3890 COMMON_AUDIT_DATA_INIT(&ad, NET);
3891 ad.selinux_audit_data = &sad;
3892 ad.u.net = &net;
3893 ad.u.net->sport = htons(snum);
3894 ad.u.net->family = family;
3895 err = avc_has_perm(sksec->sid, sid,
3896 sksec->sclass,
3897 SOCKET__NAME_BIND, &ad);
3898 if (err)
3899 goto out;
3900 }
3901 }
3902
3903 switch (sksec->sclass) {
3904 case SECCLASS_TCP_SOCKET:
3905 node_perm = TCP_SOCKET__NODE_BIND;
3906 break;
3907
3908 case SECCLASS_UDP_SOCKET:
3909 node_perm = UDP_SOCKET__NODE_BIND;
3910 break;
3911
3912 case SECCLASS_DCCP_SOCKET:
3913 node_perm = DCCP_SOCKET__NODE_BIND;
3914 break;
3915
3916 default:
3917 node_perm = RAWIP_SOCKET__NODE_BIND;
3918 break;
3919 }
3920
3921 err = sel_netnode_sid(addrp, family, &sid);
3922 if (err)
3923 goto out;
3924
3925 COMMON_AUDIT_DATA_INIT(&ad, NET);
3926 ad.selinux_audit_data = &sad;
3927 ad.u.net = &net;
3928 ad.u.net->sport = htons(snum);
3929 ad.u.net->family = family;
3930
3931 if (family == PF_INET)
3932 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3933 else
3934 ad.u.net->v6info.saddr = addr6->sin6_addr;
3935
3936 err = avc_has_perm(sksec->sid, sid,
3937 sksec->sclass, node_perm, &ad);
3938 if (err)
3939 goto out;
3940 }
3941 out:
3942 return err;
3943 }
3944
3945 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3946 {
3947 struct sock *sk = sock->sk;
3948 struct sk_security_struct *sksec = sk->sk_security;
3949 int err;
3950
3951 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3952 if (err)
3953 return err;
3954
3955 /*
3956 * If a TCP or DCCP socket, check name_connect permission for the port.
3957 */
3958 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3959 sksec->sclass == SECCLASS_DCCP_SOCKET) {
3960 struct common_audit_data ad;
3961 struct selinux_audit_data sad = {0,};
3962 struct lsm_network_audit net = {0,};
3963 struct sockaddr_in *addr4 = NULL;
3964 struct sockaddr_in6 *addr6 = NULL;
3965 unsigned short snum;
3966 u32 sid, perm;
3967
3968 if (sk->sk_family == PF_INET) {
3969 addr4 = (struct sockaddr_in *)address;
3970 if (addrlen < sizeof(struct sockaddr_in))
3971 return -EINVAL;
3972 snum = ntohs(addr4->sin_port);
3973 } else {
3974 addr6 = (struct sockaddr_in6 *)address;
3975 if (addrlen < SIN6_LEN_RFC2133)
3976 return -EINVAL;
3977 snum = ntohs(addr6->sin6_port);
3978 }
3979
3980 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3981 if (err)
3982 goto out;
3983
3984 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3985 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3986
3987 COMMON_AUDIT_DATA_INIT(&ad, NET);
3988 ad.selinux_audit_data = &sad;
3989 ad.u.net = &net;
3990 ad.u.net->dport = htons(snum);
3991 ad.u.net->family = sk->sk_family;
3992 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3993 if (err)
3994 goto out;
3995 }
3996
3997 err = selinux_netlbl_socket_connect(sk, address);
3998
3999 out:
4000 return err;
4001 }
4002
4003 static int selinux_socket_listen(struct socket *sock, int backlog)
4004 {
4005 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4006 }
4007
4008 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4009 {
4010 int err;
4011 struct inode_security_struct *isec;
4012 struct inode_security_struct *newisec;
4013
4014 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4015 if (err)
4016 return err;
4017
4018 newisec = SOCK_INODE(newsock)->i_security;
4019
4020 isec = SOCK_INODE(sock)->i_security;
4021 newisec->sclass = isec->sclass;
4022 newisec->sid = isec->sid;
4023 newisec->initialized = 1;
4024
4025 return 0;
4026 }
4027
4028 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4029 int size)
4030 {
4031 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4032 }
4033
4034 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4035 int size, int flags)
4036 {
4037 return sock_has_perm(current, sock->sk, SOCKET__READ);
4038 }
4039
4040 static int selinux_socket_getsockname(struct socket *sock)
4041 {
4042 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4043 }
4044
4045 static int selinux_socket_getpeername(struct socket *sock)
4046 {
4047 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4048 }
4049
4050 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4051 {
4052 int err;
4053
4054 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4055 if (err)
4056 return err;
4057
4058 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4059 }
4060
4061 static int selinux_socket_getsockopt(struct socket *sock, int level,
4062 int optname)
4063 {
4064 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4065 }
4066
4067 static int selinux_socket_shutdown(struct socket *sock, int how)
4068 {
4069 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4070 }
4071
4072 static int selinux_socket_unix_stream_connect(struct sock *sock,
4073 struct sock *other,
4074 struct sock *newsk)
4075 {
4076 struct sk_security_struct *sksec_sock = sock->sk_security;
4077 struct sk_security_struct *sksec_other = other->sk_security;
4078 struct sk_security_struct *sksec_new = newsk->sk_security;
4079 struct common_audit_data ad;
4080 struct selinux_audit_data sad = {0,};
4081 struct lsm_network_audit net = {0,};
4082 int err;
4083
4084 COMMON_AUDIT_DATA_INIT(&ad, NET);
4085 ad.selinux_audit_data = &sad;
4086 ad.u.net = &net;
4087 ad.u.net->sk = other;
4088
4089 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4090 sksec_other->sclass,
4091 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4092 if (err)
4093 return err;
4094
4095 /* server child socket */
4096 sksec_new->peer_sid = sksec_sock->sid;
4097 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4098 &sksec_new->sid);
4099 if (err)
4100 return err;
4101
4102 /* connecting socket */
4103 sksec_sock->peer_sid = sksec_new->sid;
4104
4105 return 0;
4106 }
4107
4108 static int selinux_socket_unix_may_send(struct socket *sock,
4109 struct socket *other)
4110 {
4111 struct sk_security_struct *ssec = sock->sk->sk_security;
4112 struct sk_security_struct *osec = other->sk->sk_security;
4113 struct common_audit_data ad;
4114 struct selinux_audit_data sad = {0,};
4115 struct lsm_network_audit net = {0,};
4116
4117 COMMON_AUDIT_DATA_INIT(&ad, NET);
4118 ad.selinux_audit_data = &sad;
4119 ad.u.net = &net;
4120 ad.u.net->sk = other->sk;
4121
4122 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4123 &ad);
4124 }
4125
4126 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4127 u32 peer_sid,
4128 struct common_audit_data *ad)
4129 {
4130 int err;
4131 u32 if_sid;
4132 u32 node_sid;
4133
4134 err = sel_netif_sid(ifindex, &if_sid);
4135 if (err)
4136 return err;
4137 err = avc_has_perm(peer_sid, if_sid,
4138 SECCLASS_NETIF, NETIF__INGRESS, ad);
4139 if (err)
4140 return err;
4141
4142 err = sel_netnode_sid(addrp, family, &node_sid);
4143 if (err)
4144 return err;
4145 return avc_has_perm(peer_sid, node_sid,
4146 SECCLASS_NODE, NODE__RECVFROM, ad);
4147 }
4148
4149 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4150 u16 family)
4151 {
4152 int err = 0;
4153 struct sk_security_struct *sksec = sk->sk_security;
4154 u32 sk_sid = sksec->sid;
4155 struct common_audit_data ad;
4156 struct selinux_audit_data sad = {0,};
4157 struct lsm_network_audit net = {0,};
4158 char *addrp;
4159
4160 COMMON_AUDIT_DATA_INIT(&ad, NET);
4161 ad.selinux_audit_data = &sad;
4162 ad.u.net = &net;
4163 ad.u.net->netif = skb->skb_iif;
4164 ad.u.net->family = family;
4165 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4166 if (err)
4167 return err;
4168
4169 if (selinux_secmark_enabled()) {
4170 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4171 PACKET__RECV, &ad);
4172 if (err)
4173 return err;
4174 }
4175
4176 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4177 if (err)
4178 return err;
4179 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4180
4181 return err;
4182 }
4183
4184 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4185 {
4186 int err;
4187 struct sk_security_struct *sksec = sk->sk_security;
4188 u16 family = sk->sk_family;
4189 u32 sk_sid = sksec->sid;
4190 struct common_audit_data ad;
4191 struct selinux_audit_data sad = {0,};
4192 struct lsm_network_audit net = {0,};
4193 char *addrp;
4194 u8 secmark_active;
4195 u8 peerlbl_active;
4196
4197 if (family != PF_INET && family != PF_INET6)
4198 return 0;
4199
4200 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4201 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4202 family = PF_INET;
4203
4204 /* If any sort of compatibility mode is enabled then handoff processing
4205 * to the selinux_sock_rcv_skb_compat() function to deal with the
4206 * special handling. We do this in an attempt to keep this function
4207 * as fast and as clean as possible. */
4208 if (!selinux_policycap_netpeer)
4209 return selinux_sock_rcv_skb_compat(sk, skb, family);
4210
4211 secmark_active = selinux_secmark_enabled();
4212 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4213 if (!secmark_active && !peerlbl_active)
4214 return 0;
4215
4216 COMMON_AUDIT_DATA_INIT(&ad, NET);
4217 ad.selinux_audit_data = &sad;
4218 ad.u.net = &net;
4219 ad.u.net->netif = skb->skb_iif;
4220 ad.u.net->family = family;
4221 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4222 if (err)
4223 return err;
4224
4225 if (peerlbl_active) {
4226 u32 peer_sid;
4227
4228 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4229 if (err)
4230 return err;
4231 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4232 peer_sid, &ad);
4233 if (err) {
4234 selinux_netlbl_err(skb, err, 0);
4235 return err;
4236 }
4237 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4238 PEER__RECV, &ad);
4239 if (err)
4240 selinux_netlbl_err(skb, err, 0);
4241 }
4242
4243 if (secmark_active) {
4244 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4245 PACKET__RECV, &ad);
4246 if (err)
4247 return err;
4248 }
4249
4250 return err;
4251 }
4252
4253 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4254 int __user *optlen, unsigned len)
4255 {
4256 int err = 0;
4257 char *scontext;
4258 u32 scontext_len;
4259 struct sk_security_struct *sksec = sock->sk->sk_security;
4260 u32 peer_sid = SECSID_NULL;
4261
4262 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4263 sksec->sclass == SECCLASS_TCP_SOCKET)
4264 peer_sid = sksec->peer_sid;
4265 if (peer_sid == SECSID_NULL)
4266 return -ENOPROTOOPT;
4267
4268 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4269 if (err)
4270 return err;
4271
4272 if (scontext_len > len) {
4273 err = -ERANGE;
4274 goto out_len;
4275 }
4276
4277 if (copy_to_user(optval, scontext, scontext_len))
4278 err = -EFAULT;
4279
4280 out_len:
4281 if (put_user(scontext_len, optlen))
4282 err = -EFAULT;
4283 kfree(scontext);
4284 return err;
4285 }
4286
4287 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4288 {
4289 u32 peer_secid = SECSID_NULL;
4290 u16 family;
4291
4292 if (skb && skb->protocol == htons(ETH_P_IP))
4293 family = PF_INET;
4294 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4295 family = PF_INET6;
4296 else if (sock)
4297 family = sock->sk->sk_family;
4298 else
4299 goto out;
4300
4301 if (sock && family == PF_UNIX)
4302 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4303 else if (skb)
4304 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4305
4306 out:
4307 *secid = peer_secid;
4308 if (peer_secid == SECSID_NULL)
4309 return -EINVAL;
4310 return 0;
4311 }
4312
4313 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4314 {
4315 struct sk_security_struct *sksec;
4316
4317 sksec = kzalloc(sizeof(*sksec), priority);
4318 if (!sksec)
4319 return -ENOMEM;
4320
4321 sksec->peer_sid = SECINITSID_UNLABELED;
4322 sksec->sid = SECINITSID_UNLABELED;
4323 selinux_netlbl_sk_security_reset(sksec);
4324 sk->sk_security = sksec;
4325
4326 return 0;
4327 }
4328
4329 static void selinux_sk_free_security(struct sock *sk)
4330 {
4331 struct sk_security_struct *sksec = sk->sk_security;
4332
4333 sk->sk_security = NULL;
4334 selinux_netlbl_sk_security_free(sksec);
4335 kfree(sksec);
4336 }
4337
4338 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4339 {
4340 struct sk_security_struct *sksec = sk->sk_security;
4341 struct sk_security_struct *newsksec = newsk->sk_security;
4342
4343 newsksec->sid = sksec->sid;
4344 newsksec->peer_sid = sksec->peer_sid;
4345 newsksec->sclass = sksec->sclass;
4346
4347 selinux_netlbl_sk_security_reset(newsksec);
4348 }
4349
4350 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4351 {
4352 if (!sk)
4353 *secid = SECINITSID_ANY_SOCKET;
4354 else {
4355 struct sk_security_struct *sksec = sk->sk_security;
4356
4357 *secid = sksec->sid;
4358 }
4359 }
4360
4361 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4362 {
4363 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4364 struct sk_security_struct *sksec = sk->sk_security;
4365
4366 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4367 sk->sk_family == PF_UNIX)
4368 isec->sid = sksec->sid;
4369 sksec->sclass = isec->sclass;
4370 }
4371
4372 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4373 struct request_sock *req)
4374 {
4375 struct sk_security_struct *sksec = sk->sk_security;
4376 int err;
4377 u16 family = sk->sk_family;
4378 u32 newsid;
4379 u32 peersid;
4380
4381 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4382 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4383 family = PF_INET;
4384
4385 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4386 if (err)
4387 return err;
4388 if (peersid == SECSID_NULL) {
4389 req->secid = sksec->sid;
4390 req->peer_secid = SECSID_NULL;
4391 } else {
4392 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4393 if (err)
4394 return err;
4395 req->secid = newsid;
4396 req->peer_secid = peersid;
4397 }
4398
4399 return selinux_netlbl_inet_conn_request(req, family);
4400 }
4401
4402 static void selinux_inet_csk_clone(struct sock *newsk,
4403 const struct request_sock *req)
4404 {
4405 struct sk_security_struct *newsksec = newsk->sk_security;
4406
4407 newsksec->sid = req->secid;
4408 newsksec->peer_sid = req->peer_secid;
4409 /* NOTE: Ideally, we should also get the isec->sid for the
4410 new socket in sync, but we don't have the isec available yet.
4411 So we will wait until sock_graft to do it, by which
4412 time it will have been created and available. */
4413
4414 /* We don't need to take any sort of lock here as we are the only
4415 * thread with access to newsksec */
4416 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4417 }
4418
4419 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4420 {
4421 u16 family = sk->sk_family;
4422 struct sk_security_struct *sksec = sk->sk_security;
4423
4424 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4425 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4426 family = PF_INET;
4427
4428 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4429 }
4430
4431 static int selinux_secmark_relabel_packet(u32 sid)
4432 {
4433 const struct task_security_struct *__tsec;
4434 u32 tsid;
4435
4436 __tsec = current_security();
4437 tsid = __tsec->sid;
4438
4439 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4440 }
4441
4442 static void selinux_secmark_refcount_inc(void)
4443 {
4444 atomic_inc(&selinux_secmark_refcount);
4445 }
4446
4447 static void selinux_secmark_refcount_dec(void)
4448 {
4449 atomic_dec(&selinux_secmark_refcount);
4450 }
4451
4452 static void selinux_req_classify_flow(const struct request_sock *req,
4453 struct flowi *fl)
4454 {
4455 fl->flowi_secid = req->secid;
4456 }
4457
4458 static int selinux_tun_dev_create(void)
4459 {
4460 u32 sid = current_sid();
4461
4462 /* we aren't taking into account the "sockcreate" SID since the socket
4463 * that is being created here is not a socket in the traditional sense,
4464 * instead it is a private sock, accessible only to the kernel, and
4465 * representing a wide range of network traffic spanning multiple
4466 * connections unlike traditional sockets - check the TUN driver to
4467 * get a better understanding of why this socket is special */
4468
4469 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4470 NULL);
4471 }
4472
4473 static void selinux_tun_dev_post_create(struct sock *sk)
4474 {
4475 struct sk_security_struct *sksec = sk->sk_security;
4476
4477 /* we don't currently perform any NetLabel based labeling here and it
4478 * isn't clear that we would want to do so anyway; while we could apply
4479 * labeling without the support of the TUN user the resulting labeled
4480 * traffic from the other end of the connection would almost certainly
4481 * cause confusion to the TUN user that had no idea network labeling
4482 * protocols were being used */
4483
4484 /* see the comments in selinux_tun_dev_create() about why we don't use
4485 * the sockcreate SID here */
4486
4487 sksec->sid = current_sid();
4488 sksec->sclass = SECCLASS_TUN_SOCKET;
4489 }
4490
4491 static int selinux_tun_dev_attach(struct sock *sk)
4492 {
4493 struct sk_security_struct *sksec = sk->sk_security;
4494 u32 sid = current_sid();
4495 int err;
4496
4497 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4498 TUN_SOCKET__RELABELFROM, NULL);
4499 if (err)
4500 return err;
4501 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4502 TUN_SOCKET__RELABELTO, NULL);
4503 if (err)
4504 return err;
4505
4506 sksec->sid = sid;
4507
4508 return 0;
4509 }
4510
4511 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4512 {
4513 int err = 0;
4514 u32 perm;
4515 struct nlmsghdr *nlh;
4516 struct sk_security_struct *sksec = sk->sk_security;
4517
4518 if (skb->len < NLMSG_SPACE(0)) {
4519 err = -EINVAL;
4520 goto out;
4521 }
4522 nlh = nlmsg_hdr(skb);
4523
4524 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4525 if (err) {
4526 if (err == -EINVAL) {
4527 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4528 "SELinux: unrecognized netlink message"
4529 " type=%hu for sclass=%hu\n",
4530 nlh->nlmsg_type, sksec->sclass);
4531 if (!selinux_enforcing || security_get_allow_unknown())
4532 err = 0;
4533 }
4534
4535 /* Ignore */
4536 if (err == -ENOENT)
4537 err = 0;
4538 goto out;
4539 }
4540
4541 err = sock_has_perm(current, sk, perm);
4542 out:
4543 return err;
4544 }
4545
4546 #ifdef CONFIG_NETFILTER
4547
4548 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4549 u16 family)
4550 {
4551 int err;
4552 char *addrp;
4553 u32 peer_sid;
4554 struct common_audit_data ad;
4555 struct selinux_audit_data sad = {0,};
4556 struct lsm_network_audit net = {0,};
4557 u8 secmark_active;
4558 u8 netlbl_active;
4559 u8 peerlbl_active;
4560
4561 if (!selinux_policycap_netpeer)
4562 return NF_ACCEPT;
4563
4564 secmark_active = selinux_secmark_enabled();
4565 netlbl_active = netlbl_enabled();
4566 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4567 if (!secmark_active && !peerlbl_active)
4568 return NF_ACCEPT;
4569
4570 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4571 return NF_DROP;
4572
4573 COMMON_AUDIT_DATA_INIT(&ad, NET);
4574 ad.selinux_audit_data = &sad;
4575 ad.u.net = &net;
4576 ad.u.net->netif = ifindex;
4577 ad.u.net->family = family;
4578 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4579 return NF_DROP;
4580
4581 if (peerlbl_active) {
4582 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4583 peer_sid, &ad);
4584 if (err) {
4585 selinux_netlbl_err(skb, err, 1);
4586 return NF_DROP;
4587 }
4588 }
4589
4590 if (secmark_active)
4591 if (avc_has_perm(peer_sid, skb->secmark,
4592 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4593 return NF_DROP;
4594
4595 if (netlbl_active)
4596 /* we do this in the FORWARD path and not the POST_ROUTING
4597 * path because we want to make sure we apply the necessary
4598 * labeling before IPsec is applied so we can leverage AH
4599 * protection */
4600 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4601 return NF_DROP;
4602
4603 return NF_ACCEPT;
4604 }
4605
4606 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4607 struct sk_buff *skb,
4608 const struct net_device *in,
4609 const struct net_device *out,
4610 int (*okfn)(struct sk_buff *))
4611 {
4612 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4613 }
4614
4615 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4616 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4617 struct sk_buff *skb,
4618 const struct net_device *in,
4619 const struct net_device *out,
4620 int (*okfn)(struct sk_buff *))
4621 {
4622 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4623 }
4624 #endif /* IPV6 */
4625
4626 static unsigned int selinux_ip_output(struct sk_buff *skb,
4627 u16 family)
4628 {
4629 u32 sid;
4630
4631 if (!netlbl_enabled())
4632 return NF_ACCEPT;
4633
4634 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4635 * because we want to make sure we apply the necessary labeling
4636 * before IPsec is applied so we can leverage AH protection */
4637 if (skb->sk) {
4638 struct sk_security_struct *sksec = skb->sk->sk_security;
4639 sid = sksec->sid;
4640 } else
4641 sid = SECINITSID_KERNEL;
4642 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4643 return NF_DROP;
4644
4645 return NF_ACCEPT;
4646 }
4647
4648 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4649 struct sk_buff *skb,
4650 const struct net_device *in,
4651 const struct net_device *out,
4652 int (*okfn)(struct sk_buff *))
4653 {
4654 return selinux_ip_output(skb, PF_INET);
4655 }
4656
4657 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4658 int ifindex,
4659 u16 family)
4660 {
4661 struct sock *sk = skb->sk;
4662 struct sk_security_struct *sksec;
4663 struct common_audit_data ad;
4664 struct selinux_audit_data sad = {0,};
4665 struct lsm_network_audit net = {0,};
4666 char *addrp;
4667 u8 proto;
4668
4669 if (sk == NULL)
4670 return NF_ACCEPT;
4671 sksec = sk->sk_security;
4672
4673 COMMON_AUDIT_DATA_INIT(&ad, NET);
4674 ad.selinux_audit_data = &sad;
4675 ad.u.net = &net;
4676 ad.u.net->netif = ifindex;
4677 ad.u.net->family = family;
4678 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4679 return NF_DROP;
4680
4681 if (selinux_secmark_enabled())
4682 if (avc_has_perm(sksec->sid, skb->secmark,
4683 SECCLASS_PACKET, PACKET__SEND, &ad))
4684 return NF_DROP_ERR(-ECONNREFUSED);
4685
4686 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4687 return NF_DROP_ERR(-ECONNREFUSED);
4688
4689 return NF_ACCEPT;
4690 }
4691
4692 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4693 u16 family)
4694 {
4695 u32 secmark_perm;
4696 u32 peer_sid;
4697 struct sock *sk;
4698 struct common_audit_data ad;
4699 struct selinux_audit_data sad = {0,};
4700 struct lsm_network_audit net = {0,};
4701 char *addrp;
4702 u8 secmark_active;
4703 u8 peerlbl_active;
4704
4705 /* If any sort of compatibility mode is enabled then handoff processing
4706 * to the selinux_ip_postroute_compat() function to deal with the
4707 * special handling. We do this in an attempt to keep this function
4708 * as fast and as clean as possible. */
4709 if (!selinux_policycap_netpeer)
4710 return selinux_ip_postroute_compat(skb, ifindex, family);
4711 #ifdef CONFIG_XFRM
4712 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4713 * packet transformation so allow the packet to pass without any checks
4714 * since we'll have another chance to perform access control checks
4715 * when the packet is on it's final way out.
4716 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4717 * is NULL, in this case go ahead and apply access control. */
4718 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4719 return NF_ACCEPT;
4720 #endif
4721 secmark_active = selinux_secmark_enabled();
4722 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4723 if (!secmark_active && !peerlbl_active)
4724 return NF_ACCEPT;
4725
4726 /* if the packet is being forwarded then get the peer label from the
4727 * packet itself; otherwise check to see if it is from a local
4728 * application or the kernel, if from an application get the peer label
4729 * from the sending socket, otherwise use the kernel's sid */
4730 sk = skb->sk;
4731 if (sk == NULL) {
4732 if (skb->skb_iif) {
4733 secmark_perm = PACKET__FORWARD_OUT;
4734 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4735 return NF_DROP;
4736 } else {
4737 secmark_perm = PACKET__SEND;
4738 peer_sid = SECINITSID_KERNEL;
4739 }
4740 } else {
4741 struct sk_security_struct *sksec = sk->sk_security;
4742 peer_sid = sksec->sid;
4743 secmark_perm = PACKET__SEND;
4744 }
4745
4746 COMMON_AUDIT_DATA_INIT(&ad, NET);
4747 ad.selinux_audit_data = &sad;
4748 ad.u.net = &net;
4749 ad.u.net->netif = ifindex;
4750 ad.u.net->family = family;
4751 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4752 return NF_DROP;
4753
4754 if (secmark_active)
4755 if (avc_has_perm(peer_sid, skb->secmark,
4756 SECCLASS_PACKET, secmark_perm, &ad))
4757 return NF_DROP_ERR(-ECONNREFUSED);
4758
4759 if (peerlbl_active) {
4760 u32 if_sid;
4761 u32 node_sid;
4762
4763 if (sel_netif_sid(ifindex, &if_sid))
4764 return NF_DROP;
4765 if (avc_has_perm(peer_sid, if_sid,
4766 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4767 return NF_DROP_ERR(-ECONNREFUSED);
4768
4769 if (sel_netnode_sid(addrp, family, &node_sid))
4770 return NF_DROP;
4771 if (avc_has_perm(peer_sid, node_sid,
4772 SECCLASS_NODE, NODE__SENDTO, &ad))
4773 return NF_DROP_ERR(-ECONNREFUSED);
4774 }
4775
4776 return NF_ACCEPT;
4777 }
4778
4779 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4780 struct sk_buff *skb,
4781 const struct net_device *in,
4782 const struct net_device *out,
4783 int (*okfn)(struct sk_buff *))
4784 {
4785 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4786 }
4787
4788 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4789 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4790 struct sk_buff *skb,
4791 const struct net_device *in,
4792 const struct net_device *out,
4793 int (*okfn)(struct sk_buff *))
4794 {
4795 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4796 }
4797 #endif /* IPV6 */
4798
4799 #endif /* CONFIG_NETFILTER */
4800
4801 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4802 {
4803 int err;
4804
4805 err = cap_netlink_send(sk, skb);
4806 if (err)
4807 return err;
4808
4809 return selinux_nlmsg_perm(sk, skb);
4810 }
4811
4812 static int ipc_alloc_security(struct task_struct *task,
4813 struct kern_ipc_perm *perm,
4814 u16 sclass)
4815 {
4816 struct ipc_security_struct *isec;
4817 u32 sid;
4818
4819 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4820 if (!isec)
4821 return -ENOMEM;
4822
4823 sid = task_sid(task);
4824 isec->sclass = sclass;
4825 isec->sid = sid;
4826 perm->security = isec;
4827
4828 return 0;
4829 }
4830
4831 static void ipc_free_security(struct kern_ipc_perm *perm)
4832 {
4833 struct ipc_security_struct *isec = perm->security;
4834 perm->security = NULL;
4835 kfree(isec);
4836 }
4837
4838 static int msg_msg_alloc_security(struct msg_msg *msg)
4839 {
4840 struct msg_security_struct *msec;
4841
4842 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4843 if (!msec)
4844 return -ENOMEM;
4845
4846 msec->sid = SECINITSID_UNLABELED;
4847 msg->security = msec;
4848
4849 return 0;
4850 }
4851
4852 static void msg_msg_free_security(struct msg_msg *msg)
4853 {
4854 struct msg_security_struct *msec = msg->security;
4855
4856 msg->security = NULL;
4857 kfree(msec);
4858 }
4859
4860 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4861 u32 perms)
4862 {
4863 struct ipc_security_struct *isec;
4864 struct common_audit_data ad;
4865 struct selinux_audit_data sad = {0,};
4866 u32 sid = current_sid();
4867
4868 isec = ipc_perms->security;
4869
4870 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4871 ad.selinux_audit_data = &sad;
4872 ad.u.ipc_id = ipc_perms->key;
4873
4874 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4875 }
4876
4877 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4878 {
4879 return msg_msg_alloc_security(msg);
4880 }
4881
4882 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4883 {
4884 msg_msg_free_security(msg);
4885 }
4886
4887 /* message queue security operations */
4888 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4889 {
4890 struct ipc_security_struct *isec;
4891 struct common_audit_data ad;
4892 struct selinux_audit_data sad = {0,};
4893 u32 sid = current_sid();
4894 int rc;
4895
4896 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4897 if (rc)
4898 return rc;
4899
4900 isec = msq->q_perm.security;
4901
4902 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4903 ad.selinux_audit_data = &sad;
4904 ad.u.ipc_id = msq->q_perm.key;
4905
4906 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4907 MSGQ__CREATE, &ad);
4908 if (rc) {
4909 ipc_free_security(&msq->q_perm);
4910 return rc;
4911 }
4912 return 0;
4913 }
4914
4915 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4916 {
4917 ipc_free_security(&msq->q_perm);
4918 }
4919
4920 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4921 {
4922 struct ipc_security_struct *isec;
4923 struct common_audit_data ad;
4924 struct selinux_audit_data sad = {0,};
4925 u32 sid = current_sid();
4926
4927 isec = msq->q_perm.security;
4928
4929 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4930 ad.selinux_audit_data = &sad;
4931 ad.u.ipc_id = msq->q_perm.key;
4932
4933 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4934 MSGQ__ASSOCIATE, &ad);
4935 }
4936
4937 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4938 {
4939 int err;
4940 int perms;
4941
4942 switch (cmd) {
4943 case IPC_INFO:
4944 case MSG_INFO:
4945 /* No specific object, just general system-wide information. */
4946 return task_has_system(current, SYSTEM__IPC_INFO);
4947 case IPC_STAT:
4948 case MSG_STAT:
4949 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4950 break;
4951 case IPC_SET:
4952 perms = MSGQ__SETATTR;
4953 break;
4954 case IPC_RMID:
4955 perms = MSGQ__DESTROY;
4956 break;
4957 default:
4958 return 0;
4959 }
4960
4961 err = ipc_has_perm(&msq->q_perm, perms);
4962 return err;
4963 }
4964
4965 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4966 {
4967 struct ipc_security_struct *isec;
4968 struct msg_security_struct *msec;
4969 struct common_audit_data ad;
4970 struct selinux_audit_data sad = {0,};
4971 u32 sid = current_sid();
4972 int rc;
4973
4974 isec = msq->q_perm.security;
4975 msec = msg->security;
4976
4977 /*
4978 * First time through, need to assign label to the message
4979 */
4980 if (msec->sid == SECINITSID_UNLABELED) {
4981 /*
4982 * Compute new sid based on current process and
4983 * message queue this message will be stored in
4984 */
4985 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4986 NULL, &msec->sid);
4987 if (rc)
4988 return rc;
4989 }
4990
4991 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4992 ad.selinux_audit_data = &sad;
4993 ad.u.ipc_id = msq->q_perm.key;
4994
4995 /* Can this process write to the queue? */
4996 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4997 MSGQ__WRITE, &ad);
4998 if (!rc)
4999 /* Can this process send the message */
5000 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5001 MSG__SEND, &ad);
5002 if (!rc)
5003 /* Can the message be put in the queue? */
5004 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5005 MSGQ__ENQUEUE, &ad);
5006
5007 return rc;
5008 }
5009
5010 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5011 struct task_struct *target,
5012 long type, int mode)
5013 {
5014 struct ipc_security_struct *isec;
5015 struct msg_security_struct *msec;
5016 struct common_audit_data ad;
5017 struct selinux_audit_data sad = {0,};
5018 u32 sid = task_sid(target);
5019 int rc;
5020
5021 isec = msq->q_perm.security;
5022 msec = msg->security;
5023
5024 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5025 ad.selinux_audit_data = &sad;
5026 ad.u.ipc_id = msq->q_perm.key;
5027
5028 rc = avc_has_perm(sid, isec->sid,
5029 SECCLASS_MSGQ, MSGQ__READ, &ad);
5030 if (!rc)
5031 rc = avc_has_perm(sid, msec->sid,
5032 SECCLASS_MSG, MSG__RECEIVE, &ad);
5033 return rc;
5034 }
5035
5036 /* Shared Memory security operations */
5037 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5038 {
5039 struct ipc_security_struct *isec;
5040 struct common_audit_data ad;
5041 struct selinux_audit_data sad = {0,};
5042 u32 sid = current_sid();
5043 int rc;
5044
5045 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5046 if (rc)
5047 return rc;
5048
5049 isec = shp->shm_perm.security;
5050
5051 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5052 ad.selinux_audit_data = &sad;
5053 ad.u.ipc_id = shp->shm_perm.key;
5054
5055 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5056 SHM__CREATE, &ad);
5057 if (rc) {
5058 ipc_free_security(&shp->shm_perm);
5059 return rc;
5060 }
5061 return 0;
5062 }
5063
5064 static void selinux_shm_free_security(struct shmid_kernel *shp)
5065 {
5066 ipc_free_security(&shp->shm_perm);
5067 }
5068
5069 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5070 {
5071 struct ipc_security_struct *isec;
5072 struct common_audit_data ad;
5073 struct selinux_audit_data sad = {0,};
5074 u32 sid = current_sid();
5075
5076 isec = shp->shm_perm.security;
5077
5078 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5079 ad.selinux_audit_data = &sad;
5080 ad.u.ipc_id = shp->shm_perm.key;
5081
5082 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5083 SHM__ASSOCIATE, &ad);
5084 }
5085
5086 /* Note, at this point, shp is locked down */
5087 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5088 {
5089 int perms;
5090 int err;
5091
5092 switch (cmd) {
5093 case IPC_INFO:
5094 case SHM_INFO:
5095 /* No specific object, just general system-wide information. */
5096 return task_has_system(current, SYSTEM__IPC_INFO);
5097 case IPC_STAT:
5098 case SHM_STAT:
5099 perms = SHM__GETATTR | SHM__ASSOCIATE;
5100 break;
5101 case IPC_SET:
5102 perms = SHM__SETATTR;
5103 break;
5104 case SHM_LOCK:
5105 case SHM_UNLOCK:
5106 perms = SHM__LOCK;
5107 break;
5108 case IPC_RMID:
5109 perms = SHM__DESTROY;
5110 break;
5111 default:
5112 return 0;
5113 }
5114
5115 err = ipc_has_perm(&shp->shm_perm, perms);
5116 return err;
5117 }
5118
5119 static int selinux_shm_shmat(struct shmid_kernel *shp,
5120 char __user *shmaddr, int shmflg)
5121 {
5122 u32 perms;
5123
5124 if (shmflg & SHM_RDONLY)
5125 perms = SHM__READ;
5126 else
5127 perms = SHM__READ | SHM__WRITE;
5128
5129 return ipc_has_perm(&shp->shm_perm, perms);
5130 }
5131
5132 /* Semaphore security operations */
5133 static int selinux_sem_alloc_security(struct sem_array *sma)
5134 {
5135 struct ipc_security_struct *isec;
5136 struct common_audit_data ad;
5137 struct selinux_audit_data sad = {0,};
5138 u32 sid = current_sid();
5139 int rc;
5140
5141 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5142 if (rc)
5143 return rc;
5144
5145 isec = sma->sem_perm.security;
5146
5147 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5148 ad.selinux_audit_data = &sad;
5149 ad.u.ipc_id = sma->sem_perm.key;
5150
5151 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5152 SEM__CREATE, &ad);
5153 if (rc) {
5154 ipc_free_security(&sma->sem_perm);
5155 return rc;
5156 }
5157 return 0;
5158 }
5159
5160 static void selinux_sem_free_security(struct sem_array *sma)
5161 {
5162 ipc_free_security(&sma->sem_perm);
5163 }
5164
5165 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5166 {
5167 struct ipc_security_struct *isec;
5168 struct common_audit_data ad;
5169 struct selinux_audit_data sad = {0,};
5170 u32 sid = current_sid();
5171
5172 isec = sma->sem_perm.security;
5173
5174 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5175 ad.selinux_audit_data = &sad;
5176 ad.u.ipc_id = sma->sem_perm.key;
5177
5178 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5179 SEM__ASSOCIATE, &ad);
5180 }
5181
5182 /* Note, at this point, sma is locked down */
5183 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5184 {
5185 int err;
5186 u32 perms;
5187
5188 switch (cmd) {
5189 case IPC_INFO:
5190 case SEM_INFO:
5191 /* No specific object, just general system-wide information. */
5192 return task_has_system(current, SYSTEM__IPC_INFO);
5193 case GETPID:
5194 case GETNCNT:
5195 case GETZCNT:
5196 perms = SEM__GETATTR;
5197 break;
5198 case GETVAL:
5199 case GETALL:
5200 perms = SEM__READ;
5201 break;
5202 case SETVAL:
5203 case SETALL:
5204 perms = SEM__WRITE;
5205 break;
5206 case IPC_RMID:
5207 perms = SEM__DESTROY;
5208 break;
5209 case IPC_SET:
5210 perms = SEM__SETATTR;
5211 break;
5212 case IPC_STAT:
5213 case SEM_STAT:
5214 perms = SEM__GETATTR | SEM__ASSOCIATE;
5215 break;
5216 default:
5217 return 0;
5218 }
5219
5220 err = ipc_has_perm(&sma->sem_perm, perms);
5221 return err;
5222 }
5223
5224 static int selinux_sem_semop(struct sem_array *sma,
5225 struct sembuf *sops, unsigned nsops, int alter)
5226 {
5227 u32 perms;
5228
5229 if (alter)
5230 perms = SEM__READ | SEM__WRITE;
5231 else
5232 perms = SEM__READ;
5233
5234 return ipc_has_perm(&sma->sem_perm, perms);
5235 }
5236
5237 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5238 {
5239 u32 av = 0;
5240
5241 av = 0;
5242 if (flag & S_IRUGO)
5243 av |= IPC__UNIX_READ;
5244 if (flag & S_IWUGO)
5245 av |= IPC__UNIX_WRITE;
5246
5247 if (av == 0)
5248 return 0;
5249
5250 return ipc_has_perm(ipcp, av);
5251 }
5252
5253 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5254 {
5255 struct ipc_security_struct *isec = ipcp->security;
5256 *secid = isec->sid;
5257 }
5258
5259 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5260 {
5261 if (inode)
5262 inode_doinit_with_dentry(inode, dentry);
5263 }
5264
5265 static int selinux_getprocattr(struct task_struct *p,
5266 char *name, char **value)
5267 {
5268 const struct task_security_struct *__tsec;
5269 u32 sid;
5270 int error;
5271 unsigned len;
5272
5273 if (current != p) {
5274 error = current_has_perm(p, PROCESS__GETATTR);
5275 if (error)
5276 return error;
5277 }
5278
5279 rcu_read_lock();
5280 __tsec = __task_cred(p)->security;
5281
5282 if (!strcmp(name, "current"))
5283 sid = __tsec->sid;
5284 else if (!strcmp(name, "prev"))
5285 sid = __tsec->osid;
5286 else if (!strcmp(name, "exec"))
5287 sid = __tsec->exec_sid;
5288 else if (!strcmp(name, "fscreate"))
5289 sid = __tsec->create_sid;
5290 else if (!strcmp(name, "keycreate"))
5291 sid = __tsec->keycreate_sid;
5292 else if (!strcmp(name, "sockcreate"))
5293 sid = __tsec->sockcreate_sid;
5294 else
5295 goto invalid;
5296 rcu_read_unlock();
5297
5298 if (!sid)
5299 return 0;
5300
5301 error = security_sid_to_context(sid, value, &len);
5302 if (error)
5303 return error;
5304 return len;
5305
5306 invalid:
5307 rcu_read_unlock();
5308 return -EINVAL;
5309 }
5310
5311 static int selinux_setprocattr(struct task_struct *p,
5312 char *name, void *value, size_t size)
5313 {
5314 struct task_security_struct *tsec;
5315 struct task_struct *tracer;
5316 struct cred *new;
5317 u32 sid = 0, ptsid;
5318 int error;
5319 char *str = value;
5320
5321 if (current != p) {
5322 /* SELinux only allows a process to change its own
5323 security attributes. */
5324 return -EACCES;
5325 }
5326
5327 /*
5328 * Basic control over ability to set these attributes at all.
5329 * current == p, but we'll pass them separately in case the
5330 * above restriction is ever removed.
5331 */
5332 if (!strcmp(name, "exec"))
5333 error = current_has_perm(p, PROCESS__SETEXEC);
5334 else if (!strcmp(name, "fscreate"))
5335 error = current_has_perm(p, PROCESS__SETFSCREATE);
5336 else if (!strcmp(name, "keycreate"))
5337 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5338 else if (!strcmp(name, "sockcreate"))
5339 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5340 else if (!strcmp(name, "current"))
5341 error = current_has_perm(p, PROCESS__SETCURRENT);
5342 else
5343 error = -EINVAL;
5344 if (error)
5345 return error;
5346
5347 /* Obtain a SID for the context, if one was specified. */
5348 if (size && str[1] && str[1] != '\n') {
5349 if (str[size-1] == '\n') {
5350 str[size-1] = 0;
5351 size--;
5352 }
5353 error = security_context_to_sid(value, size, &sid);
5354 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5355 if (!capable(CAP_MAC_ADMIN)) {
5356 struct audit_buffer *ab;
5357 size_t audit_size;
5358
5359 /* We strip a nul only if it is at the end, otherwise the
5360 * context contains a nul and we should audit that */
5361 if (str[size - 1] == '\0')
5362 audit_size = size - 1;
5363 else
5364 audit_size = size;
5365 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5366 audit_log_format(ab, "op=fscreate invalid_context=");
5367 audit_log_n_untrustedstring(ab, value, audit_size);
5368 audit_log_end(ab);
5369
5370 return error;
5371 }
5372 error = security_context_to_sid_force(value, size,
5373 &sid);
5374 }
5375 if (error)
5376 return error;
5377 }
5378
5379 new = prepare_creds();
5380 if (!new)
5381 return -ENOMEM;
5382
5383 /* Permission checking based on the specified context is
5384 performed during the actual operation (execve,
5385 open/mkdir/...), when we know the full context of the
5386 operation. See selinux_bprm_set_creds for the execve
5387 checks and may_create for the file creation checks. The
5388 operation will then fail if the context is not permitted. */
5389 tsec = new->security;
5390 if (!strcmp(name, "exec")) {
5391 tsec->exec_sid = sid;
5392 } else if (!strcmp(name, "fscreate")) {
5393 tsec->create_sid = sid;
5394 } else if (!strcmp(name, "keycreate")) {
5395 error = may_create_key(sid, p);
5396 if (error)
5397 goto abort_change;
5398 tsec->keycreate_sid = sid;
5399 } else if (!strcmp(name, "sockcreate")) {
5400 tsec->sockcreate_sid = sid;
5401 } else if (!strcmp(name, "current")) {
5402 error = -EINVAL;
5403 if (sid == 0)
5404 goto abort_change;
5405
5406 /* Only allow single threaded processes to change context */
5407 error = -EPERM;
5408 if (!current_is_single_threaded()) {
5409 error = security_bounded_transition(tsec->sid, sid);
5410 if (error)
5411 goto abort_change;
5412 }
5413
5414 /* Check permissions for the transition. */
5415 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5416 PROCESS__DYNTRANSITION, NULL);
5417 if (error)
5418 goto abort_change;
5419
5420 /* Check for ptracing, and update the task SID if ok.
5421 Otherwise, leave SID unchanged and fail. */
5422 ptsid = 0;
5423 task_lock(p);
5424 tracer = ptrace_parent(p);
5425 if (tracer)
5426 ptsid = task_sid(tracer);
5427 task_unlock(p);
5428
5429 if (tracer) {
5430 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5431 PROCESS__PTRACE, NULL);
5432 if (error)
5433 goto abort_change;
5434 }
5435
5436 tsec->sid = sid;
5437 } else {
5438 error = -EINVAL;
5439 goto abort_change;
5440 }
5441
5442 commit_creds(new);
5443 return size;
5444
5445 abort_change:
5446 abort_creds(new);
5447 return error;
5448 }
5449
5450 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5451 {
5452 return security_sid_to_context(secid, secdata, seclen);
5453 }
5454
5455 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5456 {
5457 return security_context_to_sid(secdata, seclen, secid);
5458 }
5459
5460 static void selinux_release_secctx(char *secdata, u32 seclen)
5461 {
5462 kfree(secdata);
5463 }
5464
5465 /*
5466 * called with inode->i_mutex locked
5467 */
5468 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5469 {
5470 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5471 }
5472
5473 /*
5474 * called with inode->i_mutex locked
5475 */
5476 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5477 {
5478 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5479 }
5480
5481 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5482 {
5483 int len = 0;
5484 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5485 ctx, true);
5486 if (len < 0)
5487 return len;
5488 *ctxlen = len;
5489 return 0;
5490 }
5491 #ifdef CONFIG_KEYS
5492
5493 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5494 unsigned long flags)
5495 {
5496 const struct task_security_struct *tsec;
5497 struct key_security_struct *ksec;
5498
5499 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5500 if (!ksec)
5501 return -ENOMEM;
5502
5503 tsec = cred->security;
5504 if (tsec->keycreate_sid)
5505 ksec->sid = tsec->keycreate_sid;
5506 else
5507 ksec->sid = tsec->sid;
5508
5509 k->security = ksec;
5510 return 0;
5511 }
5512
5513 static void selinux_key_free(struct key *k)
5514 {
5515 struct key_security_struct *ksec = k->security;
5516
5517 k->security = NULL;
5518 kfree(ksec);
5519 }
5520
5521 static int selinux_key_permission(key_ref_t key_ref,
5522 const struct cred *cred,
5523 key_perm_t perm)
5524 {
5525 struct key *key;
5526 struct key_security_struct *ksec;
5527 u32 sid;
5528
5529 /* if no specific permissions are requested, we skip the
5530 permission check. No serious, additional covert channels
5531 appear to be created. */
5532 if (perm == 0)
5533 return 0;
5534
5535 sid = cred_sid(cred);
5536
5537 key = key_ref_to_ptr(key_ref);
5538 ksec = key->security;
5539
5540 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5541 }
5542
5543 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5544 {
5545 struct key_security_struct *ksec = key->security;
5546 char *context = NULL;
5547 unsigned len;
5548 int rc;
5549
5550 rc = security_sid_to_context(ksec->sid, &context, &len);
5551 if (!rc)
5552 rc = len;
5553 *_buffer = context;
5554 return rc;
5555 }
5556
5557 #endif
5558
5559 static struct security_operations selinux_ops = {
5560 .name = "selinux",
5561
5562 .ptrace_access_check = selinux_ptrace_access_check,
5563 .ptrace_traceme = selinux_ptrace_traceme,
5564 .capget = selinux_capget,
5565 .capset = selinux_capset,
5566 .capable = selinux_capable,
5567 .quotactl = selinux_quotactl,
5568 .quota_on = selinux_quota_on,
5569 .syslog = selinux_syslog,
5570 .vm_enough_memory = selinux_vm_enough_memory,
5571
5572 .netlink_send = selinux_netlink_send,
5573
5574 .bprm_set_creds = selinux_bprm_set_creds,
5575 .bprm_committing_creds = selinux_bprm_committing_creds,
5576 .bprm_committed_creds = selinux_bprm_committed_creds,
5577 .bprm_secureexec = selinux_bprm_secureexec,
5578
5579 .sb_alloc_security = selinux_sb_alloc_security,
5580 .sb_free_security = selinux_sb_free_security,
5581 .sb_copy_data = selinux_sb_copy_data,
5582 .sb_remount = selinux_sb_remount,
5583 .sb_kern_mount = selinux_sb_kern_mount,
5584 .sb_show_options = selinux_sb_show_options,
5585 .sb_statfs = selinux_sb_statfs,
5586 .sb_mount = selinux_mount,
5587 .sb_umount = selinux_umount,
5588 .sb_set_mnt_opts = selinux_set_mnt_opts,
5589 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5590 .sb_parse_opts_str = selinux_parse_opts_str,
5591
5592
5593 .inode_alloc_security = selinux_inode_alloc_security,
5594 .inode_free_security = selinux_inode_free_security,
5595 .inode_init_security = selinux_inode_init_security,
5596 .inode_create = selinux_inode_create,
5597 .inode_link = selinux_inode_link,
5598 .inode_unlink = selinux_inode_unlink,
5599 .inode_symlink = selinux_inode_symlink,
5600 .inode_mkdir = selinux_inode_mkdir,
5601 .inode_rmdir = selinux_inode_rmdir,
5602 .inode_mknod = selinux_inode_mknod,
5603 .inode_rename = selinux_inode_rename,
5604 .inode_readlink = selinux_inode_readlink,
5605 .inode_follow_link = selinux_inode_follow_link,
5606 .inode_permission = selinux_inode_permission,
5607 .inode_setattr = selinux_inode_setattr,
5608 .inode_getattr = selinux_inode_getattr,
5609 .inode_setxattr = selinux_inode_setxattr,
5610 .inode_post_setxattr = selinux_inode_post_setxattr,
5611 .inode_getxattr = selinux_inode_getxattr,
5612 .inode_listxattr = selinux_inode_listxattr,
5613 .inode_removexattr = selinux_inode_removexattr,
5614 .inode_getsecurity = selinux_inode_getsecurity,
5615 .inode_setsecurity = selinux_inode_setsecurity,
5616 .inode_listsecurity = selinux_inode_listsecurity,
5617 .inode_getsecid = selinux_inode_getsecid,
5618
5619 .file_permission = selinux_file_permission,
5620 .file_alloc_security = selinux_file_alloc_security,
5621 .file_free_security = selinux_file_free_security,
5622 .file_ioctl = selinux_file_ioctl,
5623 .file_mmap = selinux_file_mmap,
5624 .file_mprotect = selinux_file_mprotect,
5625 .file_lock = selinux_file_lock,
5626 .file_fcntl = selinux_file_fcntl,
5627 .file_set_fowner = selinux_file_set_fowner,
5628 .file_send_sigiotask = selinux_file_send_sigiotask,
5629 .file_receive = selinux_file_receive,
5630
5631 .file_open = selinux_file_open,
5632
5633 .task_create = selinux_task_create,
5634 .cred_alloc_blank = selinux_cred_alloc_blank,
5635 .cred_free = selinux_cred_free,
5636 .cred_prepare = selinux_cred_prepare,
5637 .cred_transfer = selinux_cred_transfer,
5638 .kernel_act_as = selinux_kernel_act_as,
5639 .kernel_create_files_as = selinux_kernel_create_files_as,
5640 .kernel_module_request = selinux_kernel_module_request,
5641 .task_setpgid = selinux_task_setpgid,
5642 .task_getpgid = selinux_task_getpgid,
5643 .task_getsid = selinux_task_getsid,
5644 .task_getsecid = selinux_task_getsecid,
5645 .task_setnice = selinux_task_setnice,
5646 .task_setioprio = selinux_task_setioprio,
5647 .task_getioprio = selinux_task_getioprio,
5648 .task_setrlimit = selinux_task_setrlimit,
5649 .task_setscheduler = selinux_task_setscheduler,
5650 .task_getscheduler = selinux_task_getscheduler,
5651 .task_movememory = selinux_task_movememory,
5652 .task_kill = selinux_task_kill,
5653 .task_wait = selinux_task_wait,
5654 .task_to_inode = selinux_task_to_inode,
5655
5656 .ipc_permission = selinux_ipc_permission,
5657 .ipc_getsecid = selinux_ipc_getsecid,
5658
5659 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5660 .msg_msg_free_security = selinux_msg_msg_free_security,
5661
5662 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5663 .msg_queue_free_security = selinux_msg_queue_free_security,
5664 .msg_queue_associate = selinux_msg_queue_associate,
5665 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5666 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5667 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5668
5669 .shm_alloc_security = selinux_shm_alloc_security,
5670 .shm_free_security = selinux_shm_free_security,
5671 .shm_associate = selinux_shm_associate,
5672 .shm_shmctl = selinux_shm_shmctl,
5673 .shm_shmat = selinux_shm_shmat,
5674
5675 .sem_alloc_security = selinux_sem_alloc_security,
5676 .sem_free_security = selinux_sem_free_security,
5677 .sem_associate = selinux_sem_associate,
5678 .sem_semctl = selinux_sem_semctl,
5679 .sem_semop = selinux_sem_semop,
5680
5681 .d_instantiate = selinux_d_instantiate,
5682
5683 .getprocattr = selinux_getprocattr,
5684 .setprocattr = selinux_setprocattr,
5685
5686 .secid_to_secctx = selinux_secid_to_secctx,
5687 .secctx_to_secid = selinux_secctx_to_secid,
5688 .release_secctx = selinux_release_secctx,
5689 .inode_notifysecctx = selinux_inode_notifysecctx,
5690 .inode_setsecctx = selinux_inode_setsecctx,
5691 .inode_getsecctx = selinux_inode_getsecctx,
5692
5693 .unix_stream_connect = selinux_socket_unix_stream_connect,
5694 .unix_may_send = selinux_socket_unix_may_send,
5695
5696 .socket_create = selinux_socket_create,
5697 .socket_post_create = selinux_socket_post_create,
5698 .socket_bind = selinux_socket_bind,
5699 .socket_connect = selinux_socket_connect,
5700 .socket_listen = selinux_socket_listen,
5701 .socket_accept = selinux_socket_accept,
5702 .socket_sendmsg = selinux_socket_sendmsg,
5703 .socket_recvmsg = selinux_socket_recvmsg,
5704 .socket_getsockname = selinux_socket_getsockname,
5705 .socket_getpeername = selinux_socket_getpeername,
5706 .socket_getsockopt = selinux_socket_getsockopt,
5707 .socket_setsockopt = selinux_socket_setsockopt,
5708 .socket_shutdown = selinux_socket_shutdown,
5709 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5710 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5711 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5712 .sk_alloc_security = selinux_sk_alloc_security,
5713 .sk_free_security = selinux_sk_free_security,
5714 .sk_clone_security = selinux_sk_clone_security,
5715 .sk_getsecid = selinux_sk_getsecid,
5716 .sock_graft = selinux_sock_graft,
5717 .inet_conn_request = selinux_inet_conn_request,
5718 .inet_csk_clone = selinux_inet_csk_clone,
5719 .inet_conn_established = selinux_inet_conn_established,
5720 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5721 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5722 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5723 .req_classify_flow = selinux_req_classify_flow,
5724 .tun_dev_create = selinux_tun_dev_create,
5725 .tun_dev_post_create = selinux_tun_dev_post_create,
5726 .tun_dev_attach = selinux_tun_dev_attach,
5727
5728 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5729 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5730 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5731 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5732 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5733 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5734 .xfrm_state_free_security = selinux_xfrm_state_free,
5735 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5736 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5737 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5738 .xfrm_decode_session = selinux_xfrm_decode_session,
5739 #endif
5740
5741 #ifdef CONFIG_KEYS
5742 .key_alloc = selinux_key_alloc,
5743 .key_free = selinux_key_free,
5744 .key_permission = selinux_key_permission,
5745 .key_getsecurity = selinux_key_getsecurity,
5746 #endif
5747
5748 #ifdef CONFIG_AUDIT
5749 .audit_rule_init = selinux_audit_rule_init,
5750 .audit_rule_known = selinux_audit_rule_known,
5751 .audit_rule_match = selinux_audit_rule_match,
5752 .audit_rule_free = selinux_audit_rule_free,
5753 #endif
5754 };
5755
5756 static __init int selinux_init(void)
5757 {
5758 if (!security_module_enable(&selinux_ops)) {
5759 selinux_enabled = 0;
5760 return 0;
5761 }
5762
5763 if (!selinux_enabled) {
5764 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5765 return 0;
5766 }
5767
5768 printk(KERN_INFO "SELinux: Initializing.\n");
5769
5770 /* Set the security state for the initial task. */
5771 cred_init_security();
5772
5773 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5774
5775 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5776 sizeof(struct inode_security_struct),
5777 0, SLAB_PANIC, NULL);
5778 avc_init();
5779
5780 if (register_security(&selinux_ops))
5781 panic("SELinux: Unable to register with kernel.\n");
5782
5783 if (selinux_enforcing)
5784 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5785 else
5786 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5787
5788 return 0;
5789 }
5790
5791 static void delayed_superblock_init(struct super_block *sb, void *unused)
5792 {
5793 superblock_doinit(sb, NULL);
5794 }
5795
5796 void selinux_complete_init(void)
5797 {
5798 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5799
5800 /* Set up any superblocks initialized prior to the policy load. */
5801 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5802 iterate_supers(delayed_superblock_init, NULL);
5803 }
5804
5805 /* SELinux requires early initialization in order to label
5806 all processes and objects when they are created. */
5807 security_initcall(selinux_init);
5808
5809 #if defined(CONFIG_NETFILTER)
5810
5811 static struct nf_hook_ops selinux_ipv4_ops[] = {
5812 {
5813 .hook = selinux_ipv4_postroute,
5814 .owner = THIS_MODULE,
5815 .pf = PF_INET,
5816 .hooknum = NF_INET_POST_ROUTING,
5817 .priority = NF_IP_PRI_SELINUX_LAST,
5818 },
5819 {
5820 .hook = selinux_ipv4_forward,
5821 .owner = THIS_MODULE,
5822 .pf = PF_INET,
5823 .hooknum = NF_INET_FORWARD,
5824 .priority = NF_IP_PRI_SELINUX_FIRST,
5825 },
5826 {
5827 .hook = selinux_ipv4_output,
5828 .owner = THIS_MODULE,
5829 .pf = PF_INET,
5830 .hooknum = NF_INET_LOCAL_OUT,
5831 .priority = NF_IP_PRI_SELINUX_FIRST,
5832 }
5833 };
5834
5835 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5836
5837 static struct nf_hook_ops selinux_ipv6_ops[] = {
5838 {
5839 .hook = selinux_ipv6_postroute,
5840 .owner = THIS_MODULE,
5841 .pf = PF_INET6,
5842 .hooknum = NF_INET_POST_ROUTING,
5843 .priority = NF_IP6_PRI_SELINUX_LAST,
5844 },
5845 {
5846 .hook = selinux_ipv6_forward,
5847 .owner = THIS_MODULE,
5848 .pf = PF_INET6,
5849 .hooknum = NF_INET_FORWARD,
5850 .priority = NF_IP6_PRI_SELINUX_FIRST,
5851 }
5852 };
5853
5854 #endif /* IPV6 */
5855
5856 static int __init selinux_nf_ip_init(void)
5857 {
5858 int err = 0;
5859
5860 if (!selinux_enabled)
5861 goto out;
5862
5863 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5864
5865 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5866 if (err)
5867 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5868
5869 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5870 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5871 if (err)
5872 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5873 #endif /* IPV6 */
5874
5875 out:
5876 return err;
5877 }
5878
5879 __initcall(selinux_nf_ip_init);
5880
5881 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5882 static void selinux_nf_ip_exit(void)
5883 {
5884 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5885
5886 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5887 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5888 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5889 #endif /* IPV6 */
5890 }
5891 #endif
5892
5893 #else /* CONFIG_NETFILTER */
5894
5895 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5896 #define selinux_nf_ip_exit()
5897 #endif
5898
5899 #endif /* CONFIG_NETFILTER */
5900
5901 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5902 static int selinux_disabled;
5903
5904 int selinux_disable(void)
5905 {
5906 if (ss_initialized) {
5907 /* Not permitted after initial policy load. */
5908 return -EINVAL;
5909 }
5910
5911 if (selinux_disabled) {
5912 /* Only do this once. */
5913 return -EINVAL;
5914 }
5915
5916 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5917
5918 selinux_disabled = 1;
5919 selinux_enabled = 0;
5920
5921 reset_security_ops();
5922
5923 /* Try to destroy the avc node cache */
5924 avc_disable();
5925
5926 /* Unregister netfilter hooks. */
5927 selinux_nf_ip_exit();
5928
5929 /* Unregister selinuxfs. */
5930 exit_sel_fs();
5931
5932 return 0;
5933 }
5934 #endif
Linux kernel - Deliverables
This page took 0.155 seconds and 4 git commands to generate.